Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Modifies file system
Creates the following files
- nul
- %WINDIR%\temp\tarfea4.tmp
- %WINDIR%\temp\cabfea3.tmp
- %WINDIR%\temp\tare8e1.tmp
- %WINDIR%\temp\cabe8e0.tmp
- %WINDIR%\temp\tare872.tmp
- %WINDIR%\temp\cabe871.tmp
- %WINDIR%\temp\tard30c.tmp
- %WINDIR%\temp\cabd30b.tmp
- %WINDIR%\temp\tard24f.tmp
- %WINDIR%\temp\cabd24e.tmp
- %WINDIR%\temp\tarbc4e.tmp
- %WINDIR%\temp\cabbc4d.tmp
- %WINDIR%\temp\tarbc1d.tmp
- %WINDIR%\temp\cab419e.tmp
- %WINDIR%\temp\cabbc0c.tmp
- %WINDIR%\temp\caba6a6.tmp
- %WINDIR%\temp\tara677.tmp
- %WINDIR%\temp\caba676.tmp
- %WINDIR%\temp\tara646.tmp
- %WINDIR%\temp\caba635.tmp
- %WINDIR%\temp\tara5f6.tmp
- %WINDIR%\temp\caba5f5.tmp
- %WINDIR%\temp\tar9042.tmp
- %WINDIR%\temp\cab9041.tmp
- %WINDIR%\temp\tar8fe3.tmp
- %WINDIR%\temp\cab8fe2.tmp
- %WINDIR%\temp\tar79f1.tmp
- %WINDIR%\temp\cab79f0.tmp
- %WINDIR%\temp\tara6a7.tmp
- %WINDIR%\temp\tar41af.tmp
Deletes the following files
- %WINDIR%\temp\cab79f0.tmp
- %WINDIR%\temp\tarfea4.tmp
- %WINDIR%\temp\cabfea3.tmp
- %WINDIR%\temp\tare8e1.tmp
- %WINDIR%\temp\cabe8e0.tmp
- %WINDIR%\temp\tare872.tmp
- %WINDIR%\temp\cabe871.tmp
- %WINDIR%\temp\tard30c.tmp
- %WINDIR%\temp\cabd30b.tmp
- %WINDIR%\temp\tard24f.tmp
- %WINDIR%\temp\cabd24e.tmp
- %WINDIR%\temp\tarbc4e.tmp
- %WINDIR%\temp\cabbc4d.tmp
- %WINDIR%\temp\tarbc1d.tmp
- %WINDIR%\temp\cabbc0c.tmp
- %WINDIR%\temp\tara6a7.tmp
- %WINDIR%\temp\caba6a6.tmp
- %WINDIR%\temp\tara677.tmp
- %WINDIR%\temp\caba676.tmp
- %WINDIR%\temp\tara646.tmp
- %WINDIR%\temp\caba635.tmp
- %WINDIR%\temp\tara5f6.tmp
- %WINDIR%\temp\caba5f5.tmp
- %WINDIR%\temp\tar9042.tmp
- %WINDIR%\temp\cab9041.tmp
- %WINDIR%\temp\tar8fe3.tmp
- %WINDIR%\temp\cab8fe2.tmp
- %WINDIR%\temp\tar79f1.tmp
- %WINDIR%\temp\cab419e.tmp
- %WINDIR%\temp\tar41af.tmp
Network activity
Connects to
- 'localhost':49185
- 'localhost':49187
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'Everything'
- ClassName: '' WindowName: 'Detect It Easy v3.01'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x64 v0.9.8'
- ClassName: '' WindowName: 'Scylla x86 v0.9.8'
- ClassName: '' WindowName: 'FiddlerCore'
- ClassName: '' WindowName: 'FiddlerCap'
- ClassName: '' WindowName: 'Fiddler Jam'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'Fiddler Classic'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x64DBG'
- ClassName: '' WindowName: 'x32DBG'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'Cheat Engine 7.3'
- ClassName: '' WindowName: 'Cheat Engine 7.4'
- ClassName: '' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'Snowman'
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
