Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_19f269eb5eff40c98fa4b651ace0b9d2.zip
- %TEMP%\rmm_update_2d0d2dc5afeb4c70b8adcff620411553\windowsservicehost.exe
- %TEMP%\rmm_update_2d0d2dc5afeb4c70b8adcff620411553\rmm.agent.console.exe
- %TEMP%\rmm_update_2d0d2dc5afeb4c70b8adcff620411553\appsettings.json
- %TEMP%\rmm_update_2d0d2dc5afeb4c70b8adcff620411553\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\94fe6a7923db4f9f81aa37417aaaa54d.ps1
- %TEMP%\rmm_update_bc304c4967204f3abffd7bd009d07d7f.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>.rollback\<File name>.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_3870dbd7b0054e74ad5800e2e118b2cc.zip
- %TEMP%\rmm_update_8116f38ecfa74b628621b8495c75b53a\windowsservicehost.exe
- %TEMP%\rmm_update_8116f38ecfa74b628621b8495c75b53a\rmm.agent.console.exe
- %TEMP%\rmm_update_8116f38ecfa74b628621b8495c75b53a\appsettings.json
- %TEMP%\rmm_update_8116f38ecfa74b628621b8495c75b53a\vcruntime140.dll
- %TEMP%\8bc1161e58f941b0b1d65ce89ffd3803.ps1
- %TEMP%\rmm_update_17b24493af254a4790792c24d4d6350f.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_ee58ae2b0c4b491f8237773e6b3bf596.zip
- %TEMP%\rmm_update_a5e20ec739d544e5bda69542b2fe50e8\windowsservicehost.exe
- %TEMP%\rmm_update_a5e20ec739d544e5bda69542b2fe50e8\rmm.agent.console.exe
- %TEMP%\rmm_update_a5e20ec739d544e5bda69542b2fe50e8\appsettings.json
- %TEMP%\rmm_update_a5e20ec739d544e5bda69542b2fe50e8\vcruntime140.dll
- %TEMP%\8d07e9b49c3c4bf6857c515178aeeee2.ps1
- %TEMP%\rmm_update_71dd3fbcd3d741d890664e050f28e401.bat
- %TEMP%\rmm_update_6bed36b3a46b48dc9d1a759c26ae81f3.zip
- %TEMP%\rmm_update_d8601b4b286a473497023b4ae2931012\windowsservicehost.exe
- %TEMP%\rmm_update_d8601b4b286a473497023b4ae2931012\rmm.agent.console.exe
- %TEMP%\rmm_update_d8601b4b286a473497023b4ae2931012\appsettings.json
- %TEMP%\rmm_update_d8601b4b286a473497023b4ae2931012\vcruntime140.dll
- %TEMP%\569628bc0edc4727849b10b5327d5838.ps1
- %TEMP%\rmm_update_0b04b8377cda4fb89512518658503888.bat
- %TEMP%\rmm_update_8b9c350102da48779d0ccc8da58ee0b0.zip
- %TEMP%\rmm_update_70bd70ce75f24288b4c106a2ee313066\windowsservicehost.exe
- %TEMP%\rmm_update_70bd70ce75f24288b4c106a2ee313066\rmm.agent.console.exe
- %TEMP%\rmm_update_70bd70ce75f24288b4c106a2ee313066\appsettings.json
- %TEMP%\rmm_update_70bd70ce75f24288b4c106a2ee313066\vcruntime140.dll
- %TEMP%\e4e5c4c296de4598a2d9248619dfd17d.ps1
- %TEMP%\rmm_update_0321d6e7b28d4289815a600db2d2ce90.bat
- %TEMP%\rmm_update_0c4ed037ac5e4aaaaee415b3a9d643ab.zip
- %TEMP%\rmm_update_4cb8b07a217d4da7bd71c64e2e3606fb\windowsservicehost.exe
- %TEMP%\rmm_update_4cb8b07a217d4da7bd71c64e2e3606fb\rmm.agent.console.exe
- %TEMP%\rmm_update_4cb8b07a217d4da7bd71c64e2e3606fb\appsettings.json
- %TEMP%\rmm_update_4cb8b07a217d4da7bd71c64e2e3606fb\vcruntime140.dll
- %TEMP%\2f25050a05374e5caac30beacd441b34.ps1
- %TEMP%\rmm_update_ff5caec6fd54410ebdbe219cce363d33.bat
- %TEMP%\rmm_update_9b88cc2f379e4171836c4fcb15fc02e0.zip
- %TEMP%\rmm_update_131c5c7b0a5b48e3a563fbf0b54a3347\windowsservicehost.exe
- %TEMP%\rmm_update_131c5c7b0a5b48e3a563fbf0b54a3347\rmm.agent.console.exe
- %TEMP%\rmm_update_131c5c7b0a5b48e3a563fbf0b54a3347\appsettings.json
- %TEMP%\rmm_update_131c5c7b0a5b48e3a563fbf0b54a3347\vcruntime140.dll
- %TEMP%\d4315df3cc964c81852049207a09122f.ps1
- %TEMP%\rmm_update_b755fecc8bfb4752b43d84b5f0a8802b.bat
- %TEMP%\rmm_update_b9a6260b057046a7896b7a8ac0b8b2a1.zip
- %TEMP%\rmm_update_8ebec1941efc4f679db8b903736f2b86\windowsservicehost.exe
- %TEMP%\rmm_update_8ebec1941efc4f679db8b903736f2b86\rmm.agent.console.exe
- %TEMP%\rmm_update_8ebec1941efc4f679db8b903736f2b86\appsettings.json
- %TEMP%\rmm_update_8ebec1941efc4f679db8b903736f2b86\vcruntime140.dll
- %TEMP%\82d94f24fe3248729f84c057de391be1.ps1
- %TEMP%\rmm_update_0402cbe118fd4386b4768ce67fdda2ac.bat
Deletes following files that it created itself
- %TEMP%\94fe6a7923db4f9f81aa37417aaaa54d.ps1
- %TEMP%\8bc1161e58f941b0b1d65ce89ffd3803.ps1
- %TEMP%\8d07e9b49c3c4bf6857c515178aeeee2.ps1
- %TEMP%\569628bc0edc4727849b10b5327d5838.ps1
- %TEMP%\e4e5c4c296de4598a2d9248619dfd17d.ps1
- %TEMP%\2f25050a05374e5caac30beacd441b34.ps1
- %TEMP%\d4315df3cc964c81852049207a09122f.ps1
- %TEMP%\82d94f24fe3248729f84c057de391be1.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\94fe6a7923db4f9f81aa37417aaaa54d.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\8bc1161e58f941b0b1d65ce89ffd3803.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\8d07e9b49c3c4bf6857c515178aeeee2.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\569628bc0edc4727849b10b5327d5838.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\e4e5c4c296de4598a2d9248619dfd17d.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\2f25050a05374e5caac30beacd441b34.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\d4315df3cc964c81852049207a09122f.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\82d94f24fe3248729f84c057de391be1.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bc304c4967204f3abffd7bd009d07d7f.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_2d0d2dc5afeb4c70b8adcff620411553\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_17b24493af254a4790792c24d4d6350f.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_8116f38ecfa74b628621b8495c75b53a\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_71dd3fbcd3d741d890664e050f28e401.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_a5e20ec739d544e5bda69542b2fe50e8\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0b04b8377cda4fb89512518658503888.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_d8601b4b286a473497023b4ae2931012\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0321d6e7b28d4289815a600db2d2ce90.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_70bd70ce75f24288b4c106a2ee313066\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_ff5caec6fd54410ebdbe219cce363d33.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_4cb8b07a217d4da7bd71c64e2e3606fb\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_b755fecc8bfb4752b43d84b5f0a8802b.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_131c5c7b0a5b48e3a563fbf0b54a3347\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0402cbe118fd4386b4768ce67fdda2ac.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_8ebec1941efc4f679db8b903736f2b86\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\445022cad0cd4016a01797047ae9f944.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bc304c4967204f3abffd7bd009d07d7f.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_17b24493af254a4790792c24d4d6350f.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_71dd3fbcd3d741d890664e050f28e401.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0b04b8377cda4fb89512518658503888.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0321d6e7b28d4289815a600db2d2ce90.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_ff5caec6fd54410ebdbe219cce363d33.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_b755fecc8bfb4752b43d84b5f0a8802b.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0402cbe118fd4386b4768ce67fdda2ac.bat"' (with hidden window)
