Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe
Modifies file system
Creates the following files
- %TEMP%\nsheec2.tmp\sibuia.dll
- %TEMP%\sibf059.tmp\sibca.dll
- %TEMP%\sibf059.tmp\sibclr.dll
- %TEMP%\sibf059.tmp\0\setup.exe
- %ProgramFiles(x86)%\ujvqkl7ofji6\aliens.exe
- %TEMP%\85f91a36e275562f.exe
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sib.dat
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sibclr.dll
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sibca.dll
- %TEMP%\gdiview.msi
- %TEMP%\msi495e.tmp
- %LOCALAPPDATA%\cookies.sqlite1606605035270-shm
Deletes the following files
- %TEMP%\sibf059.tmp\0\setup.exe
- %TEMP%\sibf059.tmp\sibca.dll
- %TEMP%\sibf059.tmp\sibclr.dll
- %TEMP%\nsheec2.tmp\sibuia.dll
- %TEMP%\msi495e.tmp
- %ProgramFiles(x86)%\ujvqkl7ofji6\aliens.exe
- %LOCALAPPDATA%\cookies.sqlite1606605035270-shm
Network activity
Connects to
- '75#####bd6a4211b.xyz':80
TCP
HTTP POST requests
- http://75#####bd6a4211b.xyz/info/w
UDP
- DNS ASK 75#####bd6a4211b.xyz
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\sibf059.tmp\0\setup.exe' -s
- '%ProgramFiles(x86)%\ujvqkl7ofji6\aliens.exe'
- '%TEMP%\85f91a36e275562f.exe' 0011 installp1
- '%TEMP%\85f91a36e275562f.exe' 200 installp1
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\gdiview.msi"' (with hidden window)
- '%TEMP%\85f91a36e275562f.exe' 0011 installp1' (with hidden window)
- '%TEMP%\85f91a36e275562f.exe' 200 installp1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%ProgramFiles(x86)%\ujvqkl7ofji6\aliens.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\85F91A36E275562F.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\gdiview.msi"
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%ProgramFiles(x86)%\ujvqkl7ofji6\aliens.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\85F91A36E275562F.exe"
