Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' STOP BEDaisy
- '<SYSTEM32>\net.exe' STOP BEService
- '<SYSTEM32>\net.exe' STOP TesSafe
- '<SYSTEM32>\taskkill.exe' /im ExecPubg.exe /f
- '<SYSTEM32>\taskkill.exe' /im TslGame.exe /f
Modifies file system
Creates the following files
- C:\softxlic.ini
- %LOCALAPPDATA%\temp_images\images\goods_t2.png
- %LOCALAPPDATA%\temp_images\images\goods_t3.png
- %LOCALAPPDATA%\temp_images\images\goods_yl.png
- %LOCALAPPDATA%\temp_images\images\goods_ylx.png
- %LOCALAPPDATA%\temp_images\images\goods_zty.png
- %LOCALAPPDATA%\temp_images\images\gun_98k.png
- %LOCALAPPDATA%\temp_images\images\gun_akm.png
- %LOCALAPPDATA%\temp_images\images\gun_dp28.png
- %LOCALAPPDATA%\temp_images\images\gun_g36c.png
- %LOCALAPPDATA%\temp_images\images\gun_m16a4.png
- %LOCALAPPDATA%\temp_images\images\gun_m24.png
- %LOCALAPPDATA%\temp_images\images\gun_m249.png
- %LOCALAPPDATA%\temp_images\images\fix_jx.png
- %LOCALAPPDATA%\temp_images\images\gun_m416.png
- %LOCALAPPDATA%\temp_images\images\gun_mg.png
- %LOCALAPPDATA%\temp_images\images\gun_mini.png
- %LOCALAPPDATA%\temp_images\images\gun_mk47.png
- %LOCALAPPDATA%\temp_images\images\gun_p18c.png
- %LOCALAPPDATA%\temp_images\images\gun_qbu.png
- %LOCALAPPDATA%\temp_images\images\gun_qbz.png
- %LOCALAPPDATA%\temp_images\images\gun_scarl.png
- %LOCALAPPDATA%\temp_images\images\gun_sks.png
- %LOCALAPPDATA%\temp_images\images\gun_slr.png
- %LOCALAPPDATA%\temp_images\images\gun_tq.png
- %LOCALAPPDATA%\temp_images\images\gun_ump.png
- %LOCALAPPDATA%\temp_images\images\gun_vss.png
- %LOCALAPPDATA%\temp_images\images\goods_ss.png
- %LOCALAPPDATA%\temp_images\images\goods_t1.png
- %LOCALAPPDATA%\temp_images\images\goods_jjb.png
- %LOCALAPPDATA%\temp_images\images\goods_jia3.png
- %LOCALAPPDATA%\temp_images\images\goods_jia2.png
- %LOCALAPPDATA%\temp_images\images\fix_bk.png
- %LOCALAPPDATA%\temp_images\images\fix_bkk.png
- %LOCALAPPDATA%\temp_images\images\fix_bx.png
- %LOCALAPPDATA%\temp_images\images\fix_c4.png
- %LOCALAPPDATA%\temp_images\images\fix_g.png
- %LOCALAPPDATA%\temp_images\images\fix_h.png
- %LOCALAPPDATA%\temp_images\images\fix_hd.png
- %LOCALAPPDATA%\temp_images\images\fix_j2.png
- %LOCALAPPDATA%\temp_images\images\fix_j3.png
- %LOCALAPPDATA%\temp_images\images\fix_j4.png
- %LOCALAPPDATA%\temp_images\images\fix_j6.png
- %LOCALAPPDATA%\temp_images\images\fix_j8.png
- %LOCALAPPDATA%\temp_images\images\gun_win94.png
- %LOCALAPPDATA%\temp_images\images\gun_m762.png
- %LOCALAPPDATA%\temp_images\images\fix_jkk.png
- %LOCALAPPDATA%\temp_images\images\fix_m4pg.png
- %LOCALAPPDATA%\temp_images\images\fix_qx.png
- %LOCALAPPDATA%\temp_images\images\fix_qy.png
- %LOCALAPPDATA%\temp_images\images\fix_sj.png
- %LOCALAPPDATA%\temp_images\images\fix_y.png
- %LOCALAPPDATA%\temp_images\images\fix_zdd.png
- %LOCALAPPDATA%\temp_images\images\fix_zyb.png
- %LOCALAPPDATA%\temp_images\images\goods_b1.png
- %LOCALAPPDATA%\temp_images\images\goods_b2.png
- %LOCALAPPDATA%\temp_images\images\goods_b3.png
- %LOCALAPPDATA%\temp_images\images\goods_bd.png
- %LOCALAPPDATA%\temp_images\images\goods_jia1.png
- %LOCALAPPDATA%\temp_images\images\fix_bb.png
- %LOCALAPPDATA%\temp_images\images\fix_l.png
- %LOCALAPPDATA%\temp_images\images\gun_xhq.png
Network activity
Connects to
- 'bw##ro.org':33899
TCP
HTTP POST requests
- http://bw####.org:33899/kss_io/io.php?v=################################################ via bw##ro.org
UDP
- DNS ASK bw##ro.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V AutoReboot /T REG_DWORD /D 1 /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V CrashDumpEnabled /T REG_DWORD /D 0 /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C NET STOP BEDaisy' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C NET STOP BEService' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C NET STOP TesSafe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /im ExecPubg.exe /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /im TslGame.exe /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C NET START DNSCACHE' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V AutoReboot /T REG_DWORD /D 1 /F
- '<SYSTEM32>\cmd.exe' /C reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V CrashDumpEnabled /T REG_DWORD /D 0 /F
- '<SYSTEM32>\cmd.exe' /C NET STOP BEDaisy
- '<SYSTEM32>\cmd.exe' /C NET STOP BEService
- '<SYSTEM32>\cmd.exe' /C NET STOP TesSafe
- '<SYSTEM32>\cmd.exe' /C taskkill /im ExecPubg.exe /f
- '<SYSTEM32>\cmd.exe' /C taskkill /im TslGame.exe /f
- '<SYSTEM32>\cmd.exe' /C NET START DNSCACHE
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V AutoReboot /T REG_DWORD /D 1 /F
- '<SYSTEM32>\net.exe' START DNSCACHE
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /V CrashDumpEnabled /T REG_DWORD /D 0 /F
- '<SYSTEM32>\net1.exe' START DNSCACHE
- '<SYSTEM32>\net1.exe' STOP BEDaisy
- '<SYSTEM32>\net1.exe' STOP BEService
- '<SYSTEM32>\net1.exe' STOP TesSafe
