Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\regsvmcl.exe'
Injects code into
the following user processes:
- regsvmcl.exe
Modifies file system
Creates the following files
- %APPDATA%\regsvmcl.exe
- %APPDATA%\regsvcxm.exe
- %APPDATA%\betnal.exe
- %APPDATA%\nvoma.pdf
Network activity
Connects to
- 'eu##x.ps':80
TCP
HTTP GET requests
- http://eu##x.ps/vespa/betnal.exe
- http://eu##x.ps/vespa/nvoma.pdf
UDP
- DNS ASK eu##x.ps
Miscellaneous
Creates and executes the following
- '%APPDATA%\regsvcxm.exe' 0
- '%APPDATA%\betnal.exe' 0
- '%APPDATA%\betnal.exe'
- '%APPDATA%\regsvcxm.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\fBXcxKV" /XML "%TEMP%\tmp8314.tmp"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\hAoHsX" /XML "%TEMP%\tmp8315.tmp"' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%APPDATA%\nvoma.pdf"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\fBXcxKV" /XML "%TEMP%\tmp8314.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\hAoHsX" /XML "%TEMP%\tmp8315.tmp"
