Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\is-m844i.tmp\<File name>.tmp
- %APPDATA%\syncthing\is-g8ibi.tmp
- %APPDATA%\syncthing\is-25hu9.tmp
- %APPDATA%\syncthing\is-im6jl.tmp
- %TEMP%\is-5l6cc.tmp\is-huoq6.tmp
- %TEMP%\is-5l6cc.tmp\is-f7gru.tmp
- %TEMP%\is-5l6cc.tmp\is-nro5b.tmp
- %TEMP%\is-5l6cc.tmp\is-nhd03.tmp
- %TEMP%\is-5l6cc.tmp\is-aii59.tmp
- %TEMP%\is-5l6cc.tmp\is-c62dv.tmp
- %TEMP%\is-5l6cc.tmp\is-sasso.tmp
- %TEMP%\is-5l6cc.tmp\is-fgqvo.tmp
- %TEMP%\is-5l6cc.tmp\is-0j6tq.tmp
- %TEMP%\is-5l6cc.tmp\is-9oa5s.tmp
- %TEMP%\is-5l6cc.tmp\is-ddibo.tmp
- %TEMP%\is-5l6cc.tmp\is-krp0v.tmp
- %TEMP%\is-5l6cc.tmp\is-2oad2.tmp
- %TEMP%\is-5l6cc.tmp\is-kpabu.tmp
- %TEMP%\is-5l6cc.tmp\is-arndi.tmp
- %TEMP%\is-5l6cc.tmp\is-lbblu.tmp
- %TEMP%\is-5l6cc.tmp\is-uilg8.tmp
- %TEMP%\is-5l6cc.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-5l6cc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tf2s7.tmp\<File name>.tmp
- %TEMP%\is-mpmhg.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-mpmhg.tmp\_isetup\_setup64.tmp
- %ALLUSERSPROFILE%\kigsqch.a3x
- nul
Deletes the following files
- %TEMP%\is-mpmhg.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-5l6cc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5l6cc.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-5l6cc.tmp\websocket-sharp.dll
- %TEMP%\is-5l6cc.tmp\unifyscanner.dll
- %TEMP%\is-5l6cc.tmp\unifydevicedetector.dll
- %TEMP%\is-5l6cc.tmp\system.text.encodings.web.dll
- %TEMP%\is-5l6cc.tmp\system.security.accesscontrol.dll
- %TEMP%\is-5l6cc.tmp\system.runtime.windowsruntime.ui.xaml.dll
- %TEMP%\is-5l6cc.tmp\system.runtime.windowsruntime.dll
- %TEMP%\is-5l6cc.tmp\system.numerics.vectors.dll
- %TEMP%\is-5l6cc.tmp\system.memory.dll
- %TEMP%\is-5l6cc.tmp\naudio.winmm.dll
- %TEMP%\is-5l6cc.tmp\naudio.winforms.dll
- %TEMP%\is-5l6cc.tmp\naudio.wasapi.dll
- %TEMP%\is-5l6cc.tmp\naudio.midi.dll
- %TEMP%\is-5l6cc.tmp\naudio.core.dll
- %TEMP%\is-5l6cc.tmp\naudio.asio.dll
- %TEMP%\is-5l6cc.tmp\booster_dll.dll
- %TEMP%\is-5l6cc.tmp\aclogger.dll
- %TEMP%\is-m844i.tmp\<File name>.tmp
- %TEMP%\is-mpmhg.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tf2s7.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\kigsqch.a3x
Moves the following files
- from %TEMP%\is-5l6cc.tmp\is-uilg8.tmp to %TEMP%\is-5l6cc.tmp\aclogger.dll
- from %APPDATA%\syncthing\is-im6jl.tmp to %APPDATA%\syncthing\scanner.exe
- from %TEMP%\is-5l6cc.tmp\is-huoq6.tmp to %TEMP%\is-5l6cc.tmp\websocket-sharp.dll
- from %TEMP%\is-5l6cc.tmp\is-f7gru.tmp to %TEMP%\is-5l6cc.tmp\unifyscanner.dll
- from %TEMP%\is-5l6cc.tmp\is-nro5b.tmp to %TEMP%\is-5l6cc.tmp\unifydevicedetector.dll
- from %TEMP%\is-5l6cc.tmp\is-nhd03.tmp to %TEMP%\is-5l6cc.tmp\system.text.encodings.web.dll
- from %TEMP%\is-5l6cc.tmp\is-aii59.tmp to %TEMP%\is-5l6cc.tmp\system.security.accesscontrol.dll
- from %TEMP%\is-5l6cc.tmp\is-c62dv.tmp to %TEMP%\is-5l6cc.tmp\system.runtime.windowsruntime.ui.xaml.dll
- from %TEMP%\is-5l6cc.tmp\is-sasso.tmp to %TEMP%\is-5l6cc.tmp\system.runtime.windowsruntime.dll
- from %TEMP%\is-5l6cc.tmp\is-fgqvo.tmp to %TEMP%\is-5l6cc.tmp\system.numerics.vectors.dll
- from %TEMP%\is-5l6cc.tmp\is-0j6tq.tmp to %TEMP%\is-5l6cc.tmp\system.memory.dll
- from %TEMP%\is-5l6cc.tmp\is-9oa5s.tmp to %TEMP%\is-5l6cc.tmp\naudio.winmm.dll
- from %TEMP%\is-5l6cc.tmp\is-ddibo.tmp to %TEMP%\is-5l6cc.tmp\naudio.winforms.dll
- from %TEMP%\is-5l6cc.tmp\is-krp0v.tmp to %TEMP%\is-5l6cc.tmp\naudio.wasapi.dll
- from %TEMP%\is-5l6cc.tmp\is-2oad2.tmp to %TEMP%\is-5l6cc.tmp\naudio.midi.dll
- from %TEMP%\is-5l6cc.tmp\is-kpabu.tmp to %TEMP%\is-5l6cc.tmp\naudio.core.dll
- from %TEMP%\is-5l6cc.tmp\is-arndi.tmp to %TEMP%\is-5l6cc.tmp\naudio.asio.dll
- from %TEMP%\is-5l6cc.tmp\is-lbblu.tmp to %TEMP%\is-5l6cc.tmp\booster_dll.dll
- from %APPDATA%\syncthing\is-25hu9.tmp to %APPDATA%\syncthing\phylloptosis.eml
- from %APPDATA%\syncthing\is-g8ibi.tmp to %APPDATA%\syncthing\phylloptosis.xls
Miscellaneous
Creates and executes the following
- '%TEMP%\is-m844i.tmp\<File name>.tmp' /SL5="$5023E,3560728,812032,<Full path to file>"
- '%TEMP%\is-tf2s7.tmp\<File name>.tmp' /SL5="$50240,3560728,812032,<Full path to file>" /VERYSILENT
- '%APPDATA%\syncthing\scanner.exe' "%APPDATA%\syncthing\\phylloptosis.eml"
- '%APPDATA%\syncthing\scanner.exe' %ALLUSERSPROFILE%\\KigsqCH.a3x
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
- '<SYSTEM32>\find.exe' /I "nswscsvc.exe"
- '<SYSTEM32>\find.exe' /I "avgui.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "sophoshealth.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && scanner.exe %ALLUSERSPROFILE%\\KigsqCH.a3x && del %ALLUSERSPROFILE%\\KigsqCH.a3x
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
- '<SYSTEM32>\find.exe' /I "avastui.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "wrsa.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "opssvc.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && scanner.exe %ALLUSERSPROFILE%\\KigsqCH.a3x && del %ALLUSERSPROFILE%\\KigsqCH.a3x' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"' (with hidden window)
