Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_e0751951edb84c8b8f0967dc8177d166.zip
- %TEMP%\rmm_update_cbd05c16e9fc4a04bfed55a8bad6b164\windowsservicehost.exe
- %TEMP%\rmm_update_cbd05c16e9fc4a04bfed55a8bad6b164\rmm.agent.console.exe
- %TEMP%\rmm_update_cbd05c16e9fc4a04bfed55a8bad6b164\appsettings.json
- %TEMP%\rmm_update_cbd05c16e9fc4a04bfed55a8bad6b164\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\b9e6b2b52a7342d687415adb76aabd3f.ps1
- %TEMP%\rmm_update_245bf45707464123afc480f9ce2c677f.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>.rollback\<File name>.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_a270cfb9802d4252856cd16d46973db2.zip
- %TEMP%\rmm_update_799e74e1f9794f34831474402a7c8c85\windowsservicehost.exe
- %TEMP%\rmm_update_799e74e1f9794f34831474402a7c8c85\rmm.agent.console.exe
- %TEMP%\rmm_update_799e74e1f9794f34831474402a7c8c85\appsettings.json
- %TEMP%\rmm_update_799e74e1f9794f34831474402a7c8c85\vcruntime140.dll
- %TEMP%\ce896c7c99f9403bb80391c4003b763e.ps1
- %TEMP%\rmm_update_97475b6ebe42484d834671c16ff4c2a5.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_9553bfeb026346258596fafcda5881d0.zip
- %TEMP%\rmm_update_c8436df664d54010835b284786c554fe\windowsservicehost.exe
- %TEMP%\rmm_update_c8436df664d54010835b284786c554fe\rmm.agent.console.exe
- %TEMP%\rmm_update_c8436df664d54010835b284786c554fe\appsettings.json
- %TEMP%\rmm_update_c8436df664d54010835b284786c554fe\vcruntime140.dll
- %TEMP%\8734e18fcf674b85a23516fcf4973e6a.ps1
- %TEMP%\rmm_update_79a2c92a1b0a4ae6a25f1218fdc27e50.bat
- %TEMP%\rmm_update_9344eaba1c094af989968e5eac2be933.zip
- %TEMP%\rmm_update_e62054a8d7ec41cc83d5685b1533024b\windowsservicehost.exe
- %TEMP%\rmm_update_e62054a8d7ec41cc83d5685b1533024b\rmm.agent.console.exe
- %TEMP%\rmm_update_e62054a8d7ec41cc83d5685b1533024b\appsettings.json
- %TEMP%\rmm_update_e62054a8d7ec41cc83d5685b1533024b\vcruntime140.dll
- %TEMP%\d36b76d8f922480f889ce71c8062607b.ps1
- %TEMP%\rmm_update_6e7e380ed2f046d488aa80998193d3ba.bat
- %TEMP%\rmm_update_6b74d0b6b0f14829b4ed26d05e680fff.zip
- %TEMP%\rmm_update_26b66cab858e487b82dfa473a278aa24\windowsservicehost.exe
- %TEMP%\rmm_update_26b66cab858e487b82dfa473a278aa24\rmm.agent.console.exe
- %TEMP%\rmm_update_26b66cab858e487b82dfa473a278aa24\appsettings.json
- %TEMP%\rmm_update_26b66cab858e487b82dfa473a278aa24\vcruntime140.dll
- %TEMP%\f5ddedc752744eedb8274af498213467.ps1
- %TEMP%\rmm_update_d58ee65c5f394de38c0e4af639b0f390.bat
- %TEMP%\rmm_update_2eefe0d662f1420589bb36ff093a472a.zip
- %TEMP%\rmm_update_65320073616d410a91c8ad6e83008ed2\windowsservicehost.exe
- %TEMP%\rmm_update_65320073616d410a91c8ad6e83008ed2\rmm.agent.console.exe
- %TEMP%\rmm_update_65320073616d410a91c8ad6e83008ed2\appsettings.json
- %TEMP%\rmm_update_65320073616d410a91c8ad6e83008ed2\vcruntime140.dll
- %TEMP%\8ad501b23d0c425894ca99cb0ee809bb.ps1
- %TEMP%\rmm_update_ee95b29fd63d46b69ff6bcf1a5f7f02c.bat
- %TEMP%\rmm_update_ee6c3deac27247bdb0ce7bb031235d48.zip
Deletes following files that it created itself
- %TEMP%\b9e6b2b52a7342d687415adb76aabd3f.ps1
- %TEMP%\ce896c7c99f9403bb80391c4003b763e.ps1
- %TEMP%\8734e18fcf674b85a23516fcf4973e6a.ps1
- %TEMP%\d36b76d8f922480f889ce71c8062607b.ps1
- %TEMP%\f5ddedc752744eedb8274af498213467.ps1
- %TEMP%\8ad501b23d0c425894ca99cb0ee809bb.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\b9e6b2b52a7342d687415adb76aabd3f.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\ce896c7c99f9403bb80391c4003b763e.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\8734e18fcf674b85a23516fcf4973e6a.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\d36b76d8f922480f889ce71c8062607b.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\f5ddedc752744eedb8274af498213467.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\8ad501b23d0c425894ca99cb0ee809bb.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_245bf45707464123afc480f9ce2c677f.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_cbd05c16e9fc4a04bfed55a8bad6b164\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_97475b6ebe42484d834671c16ff4c2a5.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_799e74e1f9794f34831474402a7c8c85\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_79a2c92a1b0a4ae6a25f1218fdc27e50.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_c8436df664d54010835b284786c554fe\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_6e7e380ed2f046d488aa80998193d3ba.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_e62054a8d7ec41cc83d5685b1533024b\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d58ee65c5f394de38c0e4af639b0f390.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_26b66cab858e487b82dfa473a278aa24\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_ee95b29fd63d46b69ff6bcf1a5f7f02c.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_65320073616d410a91c8ad6e83008ed2\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\f1310c8f43114c84a164a7e99033d6c9.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_f35d0c4bac8146d4a8b587945ce761e5.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_f9a83e3d014342b785685c08b966a42d\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_245bf45707464123afc480f9ce2c677f.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_97475b6ebe42484d834671c16ff4c2a5.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_79a2c92a1b0a4ae6a25f1218fdc27e50.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_6e7e380ed2f046d488aa80998193d3ba.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d58ee65c5f394de38c0e4af639b0f390.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_ee95b29fd63d46b69ff6bcf1a5f7f02c.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_f35d0c4bac8146d4a8b587945ce761e5.bat"' (with hidden window)
