Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'GoogleUpdMonitor' = '"%LOCALAPPDATA%\Google\Chrome\jn8gzoh2f2\GoogleBrowserEngine.exe" /user'
Malicious functions
Intercepts control using hardware breakpoints
in NTDLL dll
- googlewebcache.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\jn8gzoh2f2\googleupdate.dll
- %LOCALAPPDATA%\google\chrome\jn8gzoh2f2\googlewebcache.exe
- %LOCALAPPDATA%\google\chrome\jn8gzoh2f2\chromerecovery.exe
- %LOCALAPPDATA%\google\chrome\jn8gzoh2f2\googlebrowserengine.exe
Network activity
Connects to
- 'xm#####.nanopool.org':10343
TCP
Other
- 'xm#####.nanopool.org':10343
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\jn8gzoh2f2\googlewebcache.exe'
- '%LOCALAPPDATA%\google\chrome\jn8gzoh2f2\chromerecovery.exe' /watchu
Executes the following
- '%LOCALAPPDATA%\google\chrome\jn8gzoh2f2\googlewebcache.exe' ' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\jn8gzoh2f2\chromerecovery.exe' /watchu' (with hidden window)
