Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- %TEMP%\dpbtgm3m\dpbtgm3m.0.cs
- %TEMP%\dpbtgm3m\dpbtgm3m.cmdline
- %TEMP%\dpbtgm3m\dpbtgm3m.out
Deletes following files that it created itself
- %TEMP%\dpbtgm3m\dpbtgm3m.cmdline
- %TEMP%\dpbtgm3m\dpbtgm3m.out
- %TEMP%\dpbtgm3m\dpbtgm3m.0.cs
Network activity
Connects to
- 'ap#.#pify.org':443
TCP
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK si####-harvester.cc
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFir...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,u...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dpbtgm3m\dpbtgm3m.cmdline"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic sounddev get Name /format:list"
- '<SYSTEM32>\wbem\wmic.exe' sounddev get Name /format:list
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Enum\USB" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Enum\USB"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() +...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() + 'x' + [System.Window...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process -ErrorAction SilentlyContinue).Count""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process -ErrorAction SilentlyContinue).Count"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object D...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Widt...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFir...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFi...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dpbtgm3m\dpbtgm3m.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic sounddev get Name /format:list"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Enum\USB" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() +...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process -ErrorAction SilentlyContinue).Count""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object D...' (with hidden window)
