Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SLUpdater' = 'rundll32.exe "%APPDATA%\stager.dll",Bootstrap'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\sihost.exe
Modifies file system
Creates the following files
- %TEMP%\onefile_1776_103468_e6hethtlf0g\bundler_script.dll
- %TEMP%\onefile_1776_103468_e6hethtlf0g\_bz2.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\_decimal.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\_hashlib.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\_lzma.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\_wmi.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\libcrypto-3.dll
- %TEMP%\onefile_1776_103468_e6hethtlf0g\python312.dll
- %TEMP%\onefile_1776_103468_e6hethtlf0g\select.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\unicodedata.pyd
- %TEMP%\onefile_1776_103468_e6hethtlf0g\vcruntime140.dll
- %TEMP%\onefile_1776_103468_e6hethtlf0g\vcruntime140_1.dll
- %TEMP%\mbbh_66u
- %TEMP%\kuaimiao_win.exe
- %TEMP%\234234r.exe
- %APPDATA%\stager.dll
- %TEMP%\sl_dbg.log
- %TEMP%\is-geufc.tmp\kuaimiao_win.tmp
Deletes following files that it created itself
- %TEMP%\mbbh_66u
Network activity
Connects to
- '<LOCALNET>.159.134':8888
Miscellaneous
Creates and executes the following
- '%TEMP%\234234r.exe'
- '%TEMP%\kuaimiao_win.exe'
- '%TEMP%\is-geufc.tmp\kuaimiao_win.tmp' /SL5="$B017E,52229164,842752,%TEMP%\kuaimiao_win.exe"
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\kuaimiao_win.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\234234r.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\kuaimiao_win.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\234234r.exe"' (with hidden window)
