Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\repeat_<File name>_user
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\RunMeSvc] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\RunMeSvc] 'ImagePath' = '%WINDIR%\SysWOW64\rmsvc.exe'
- [HKLM\System\CurrentControlSet\Services\ProcessHelperSvc] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ProcessHelperSvc] 'ImagePath' = '%WINDIR%\SysWOW64\ProcessHelper.exe'
Creates the following services
- 'RunMeSvc' %WINDIR%\SysWOW64\rmsvc.exe
- 'ProcessHelperSvc' %WINDIR%\SysWOW64\ProcessHelper.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SystemAuditClient.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rmsvc.exe /IM RunMe.exe
Modifies file system
Creates the following files
- %TEMP%\sdelete.exe
- <Current directory>\tools\api-ms-win-crt-utility-l1-1-0.dll
- <Current directory>\tools\ucrtbase.dll
- <Current directory>\tools\libcrypto-1_1.dll
- <Current directory>\tools\libeay32.dll
- <Current directory>\tools\libssl-1_1.dll
- <Current directory>\tools\ssleay32.dll
- <Current directory>\tools\pdfium.dll
- <Current directory>\tools\api-ms-win-core-processthreads-l1-1-1.dll
- <Current directory>\tools\encryptfile.exe
- %WINDIR%\help\runme.dat
- %TEMP%\rmsvc.user.log
- %WINDIR%\temp\rmsvc.system.log
- %WINDIR%\help\agm01f01.hlp
- D:\{2007d07e-3574-4e26-81e0-759ab52fd301}\agm01f01.hlp
- <Current directory>\~no_client.tmp
- %WINDIR%\syswow64\processhelper.exe
- <Current directory>\tools\api-ms-win-crt-string-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-time-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-stdio-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-runtime-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-multibyte-l1-1-0.dll
- <Current directory>\tools\msvcr100.dll
- <Current directory>\tools\msvcr120.dll
- <Current directory>\tools\msvcp120.dll
- <Current directory>\tools\msvcp140.dll
- <Current directory>\tools\vcruntime140.dll
- <Current directory>\tools\api-ms-win-core-file-l1-2-0.dll
- <Current directory>\tools\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\smartctl.exe
- %WINDIR%\syswow64\rmsvc.exe
- <Current directory>\tools\api-ms-win-core-localization-l1-2-0.dll
- <Current directory>\tools\api-ms-win-core-timezone-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-convert-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-environment-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-filesystem-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-heap-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-locale-l1-1-0.dll
- <Current directory>\tools\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\movefile.exe
- <Current directory>\tools\api-ms-win-core-synch-l1-2-0.dll
- <Current directory>\localcheck\policy\localstatus.flag
Sets the 'hidden' attribute to the following files
- D:\{2007d07e-3574-4e26-81e0-759ab52fd301}\agm01f01.hlp
Deletes the following files
- D:\{2007d07e-3574-4e26-81e0-759ab52fd301}\agm01f01.hlp
Substitutes the following files
- D:\{2007d07e-3574-4e26-81e0-759ab52fd301}\agm01f01.hlp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'doc2txt.exe'
- ClassName: '' WindowName: 'a2tcmd.exe'
- ClassName: '' WindowName: 'Application Error'
- ClassName: '' WindowName: 'DFF5D33592BA33A458.TMP'
- ClassName: '' WindowName: 'ocr.exe - 应用程序错误'
- ClassName: '' WindowName: 'Microsoft Visual C++ Runtime Library'
Creates and executes the following
- '%WINDIR%\syswow64\rmsvc.exe' /Install /Silent
- '%WINDIR%\syswow64\rmsvc.exe'
- '%WINDIR%\syswow64\processhelper.exe' /Install /Silent
- '%WINDIR%\syswow64\processhelper.exe'
- '%TEMP%\smartctl.exe' -i /dev/sda
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "LOGON_SystemAuditClient_user"
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "LOGON_<File name>_user"
- '%WINDIR%\syswow64\net1.exe' start ProcessHelperSvc
- '%WINDIR%\syswow64\net.exe' start ProcessHelperSvc
- '%WINDIR%\syswow64\net.exe' start RunMeSvc
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\processhelper....
- '%WINDIR%\syswow64\net1.exe' start RunMeSvc
- '%WINDIR%\syswow64\schtasks.exe' /create /F /tn "REPEAT_<File name>_user" /tr "\"<Full path to file>"\" /sc MINUTE /mo 2 /RL HIGHEST
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\smartctl.exe" -i /dev/sda
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "REPEAT_SystemAuditClient_user"
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "LOGON_SystemAuditClient_user"' (with hidden window)
- '%WINDIR%\syswow64\processhelper.exe' /Install /Silent' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "REPEAT_SystemAuditClient_user"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SystemAuditClient.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn "LOGON_<File name>_user"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start RunMeSvc' (with hidden window)
- '%WINDIR%\syswow64\rmsvc.exe' /Install /Silent' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rmsvc.exe /IM RunMe.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /F /tn "REPEAT_<File name>_user" /tr "\"<Full path to file>"\" /sc MINUTE /mo 2 /RL HIGHEST' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start ProcessHelperSvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\smartctl.exe" -i /dev/sda' (with hidden window)
