Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
Injects code into
the following user processes:
- 624228fe19d73_mon21f9720b444f.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDBg'
Modifies file system
Creates the following files
- %TEMP%\7zs8a426288\624228daca175_mon21400a72.exe
- %TEMP%\is-e6rgj.tmp\_isetup\_setup64.tmp
- %TEMP%\is-e6rgj.tmp\idp.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %TEMP%\7zs8a426288\6242290044a6f_mon21da60e7124c.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\eav7p4im\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p4jv1ccs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rhccc3x9\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\is-6otfs.tmp\624228de36594_mon21f06e8b65.tmp
- %TEMP%\m8tds.ti
- %TEMP%\is-9lfph.tmp\_isetup\_setup64.tmp
- %TEMP%\is-n27ja.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-n27ja.tmp\idp.dll
- %TEMP%\is-n27ja.tmp\_isetup\_setup64.tmp
- %TEMP%\is-t88h1.tmp\624228de36594_mon21f06e8b65.tmp
- %TEMP%\is-foggj.tmp\624228ff27d5c_mon21b7f1ec.tmp
- %TEMP%\7zs8a426288\624228dc83e53_mon21a5c3b11ffd.exe
- %TEMP%\7zs8a426288\624228de36594_mon21f06e8b65.exe
- %TEMP%\7zs8a426288\624228e00e88a_mon219a51631dd.exe
- %TEMP%\7zs8a426288\624228e2b459d_mon21df7c4e75d.exe
- %TEMP%\7zs8a426288\624228f9a6e9c_mon21882c785f1.exe
- %TEMP%\7zs8a426288\624228fb7fb58_mon21e12828336.exe
- %TEMP%\7zs8a426288\624228fe19d73_mon21f9720b444f.exe
- %TEMP%\is-9lfph.tmp\idp.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\gyapzhvs\desktop.ini
- %TEMP%\7zs8a426288\624228ff27d5c_mon21b7f1ec.exe
- %TEMP%\7zs8a426288\62422904615df_mon21e010802.exe
- %TEMP%\7zs8a426288\libcurl.dll
- %TEMP%\7zs8a426288\libcurlpp.dll
- %TEMP%\7zs8a426288\libgcc_s_dw2-1.dll
- %TEMP%\7zs8a426288\libstdc++-6.dll
- %TEMP%\7zs8a426288\libwinpthread-1.dll
- %TEMP%\7zs8a426288\setup_install.exe
- %TEMP%\7zs8a426288\624228dba074e_mon210cde392fb.exe
- %TEMP%\7zs8a426288\62422902ee8ab_mon21fb7b707f20.exe
- %TEMP%\b3j1lb82m25fk4c.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\eav7p4im\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\gyapzhvs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p4jv1ccs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rhccc3x9\desktop.ini
Deletes the following files
- %TEMP%\7zs8a426288\624228daca175_mon21400a72.exe
- %TEMP%\is-e6rgj.tmp\idp.dll
- %TEMP%\is-e6rgj.tmp\_isetup\_setup64.tmp
- %TEMP%\is-n27ja.tmp\idp.dll
- %TEMP%\is-n27ja.tmp\_isetup\_setup64.tmp
- %TEMP%\is-n27ja.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-foggj.tmp\624228ff27d5c_mon21b7f1ec.tmp
- %TEMP%\is-t88h1.tmp\624228de36594_mon21f06e8b65.tmp
- %TEMP%\7zs8a426288\624228fe19d73_mon21f9720b444f.exe
Network activity
Connects to
- 'ic##eps.com':443
- 'ip###ger.org':443
- 'oo########ghts.s3.pl-waw.scw.cloud':80
- 'sp###########trh4mbk323pz.s3.pl-waw.scw.cloud':80
- 'v.###gamev.com':443
- 'ce####9.tmweb.ru':80
- 'vh###.timeweb.ru':443
- 'localhost':80
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://oo########ghts.s3.pl-waw.scw.cloud/sublime-publish/poweroff.exe
- http://sp###########trh4mbk323pz.s3.pl-waw.scw.cloud/advertiser-owl/poweroff.exe
- http://ce####9.tmweb.ru/arxiv.zip
- http://ip##pi.com/json/
Other
- 'ic##eps.com':443
- 'ip###ger.org':443
- 'v.###gamev.com':443
- 'ce####9.tmweb.ru':443
UDP
- DNS ASK ic##eps.com
- DNS ASK to####hnewsinc.com
- DNS ASK gl#####ealthystart.com
- DNS ASK al####art-green.com
- DNS ASK ga####rsoftwera.com
- DNS ASK fa####n-academy.net
- DNS ASK ip##pi.com
- DNS ASK ge##ek.com
- DNS ASK bl####k1.beget.tech
- DNS ASK ap###bstat.biz
- DNS ASK vh###.timeweb.ru
- DNS ASK ce####9.tmweb.ru
- DNS ASK sp###########trh4mbk323pz.s3.pl-waw.scw.cloud
- DNS ASK oo########ghts.s3.pl-waw.scw.cloud
- DNS ASK ip###ger.org
- DNS ASK v.###gamev.com
- DNS ASK al######le-pa1ments.com.mx
- DNS ASK bu######asy-fo0tball.com.sg
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ID' WindowName: ''
- ClassName: 'ObsidianGUI' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
Creates and executes the following
- '%TEMP%\7zs8a426288\setup_install.exe'
- '%TEMP%\7zs8a426288\624228dc83e53_mon21a5c3b11ffd.exe' -h
- '%TEMP%\7zs8a426288\624228de36594_mon21f06e8b65.exe' /SILENT
- '%TEMP%\is-t88h1.tmp\624228de36594_mon21f06e8b65.tmp' /SL5="$9016E,870458,780800,%TEMP%\7zS8A426288\624228de36594_Mon21f06e8b65.exe"
- '%TEMP%\is-foggj.tmp\624228ff27d5c_mon21b7f1ec.tmp' /SL5="$110170,140006,56320,%TEMP%\7zS8A426288\624228ff27d5c_Mon21b7f1ec.exe"
- '%TEMP%\7zs8a426288\624228fb7fb58_mon21e12828336.exe'
- '%TEMP%\7zs8a426288\6242290044a6f_mon21da60e7124c.exe'
- '%TEMP%\7zs8a426288\62422904615df_mon21e010802.exe'
- '%TEMP%\7zs8a426288\624228f9a6e9c_mon21882c785f1.exe' /mixtwo
- '%TEMP%\7zs8a426288\624228fe19d73_mon21f9720b444f.exe'
- '%TEMP%\7zs8a426288\624228dc83e53_mon21a5c3b11ffd.exe'
- '%TEMP%\7zs8a426288\624228e00e88a_mon219a51631dd.exe'
- '%TEMP%\7zs8a426288\62422902ee8ab_mon21fb7b707f20.exe'
- '%TEMP%\7zs8a426288\624228dba074e_mon210cde392fb.exe'
- '%TEMP%\7zs8a426288\624228e2b459d_mon21df7c4e75d.exe'
- '%TEMP%\7zs8a426288\624228de36594_mon21f06e8b65.exe'
- '%TEMP%\7zs8a426288\624228ff27d5c_mon21b7f1ec.exe'
- '%TEMP%\7zs8a426288\624228daca175_mon21400a72.exe'
- '%TEMP%\is-6otfs.tmp\624228de36594_mon21f06e8b65.tmp' /SL5="$202A0,870458,780800,%TEMP%\7zS8A426288\624228de36594_Mon21f06e8b65.exe" /SILENT
- '%TEMP%\b3j1lb82m25fk4c.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c 624228daca175_Mon21400a72.exe
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\cmd.exe' /c 62422904615df_Mon21e010802.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6242290044a6f_Mon21da60e7124c.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62422902ee8ab_Mon21fb7b707f20.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228ff27d5c_Mon21b7f1ec.exe
- '%WINDIR%\syswow64\control.exe' .\M8TDS.TI
- '%WINDIR%\syswow64\cmd.exe' /c 624228fe19d73_Mon21f9720b444f.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228f9a6e9c_Mon21882c785f1.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 624228e2b459d_Mon21df7c4e75d.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228de36594_Mon21f06e8b65.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228e00e88a_Mon219a51631dd.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228dc83e53_Mon21a5c3b11ffd.exe
- '%WINDIR%\syswow64\cmd.exe' /c 624228dba074e_Mon210cde392fb.exe
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c 624228fb7fb58_Mon21e12828336.exe
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL .\M8TDS.TI
