Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
Injects code into
the following user processes:
- 622bc5383756b_fri2163d34f.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDBg'
Modifies file system
Creates the following files
- %TEMP%\7zscf2d2753\622bc5363cc16_fri21e471f4.exe
- %TEMP%\is-bsaev.tmp\idp.dll
- %TEMP%\yhjo0y.cpl
- %TEMP%\is-26neh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-26neh.tmp\idp.dll
- %TEMP%\is-nb70k.tmp\622bc53adca68_fri21cbb0dd.tmp
- %TEMP%\is-bsaev.tmp\5(6665____.exe
- %TEMP%\is-bsaev.tmp\_isetup\_setup64.tmp
- %TEMP%\is-bsaev.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-pj7o5.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\icon.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\aes.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\jquery-3.3.1.min.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\mode-ecb.js
- %TEMP%\is-pj7o5.tmp\idp.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\background.html
- %TEMP%\is-o7k0f.tmp\622bc53adca68_fri21cbb0dd.tmp
- %TEMP%\is-vgpqo.tmp\622bc56ff1e7f_fri21501486eec0.tmp
- %TEMP%\7zscf2d2753\setup_install.exe
- %TEMP%\7zscf2d2753\622bc5383756b_fri2163d34f.exe
- %TEMP%\7zscf2d2753\622bc539162f8_fri218e20ca3f90.exe
- %TEMP%\7zscf2d2753\622bc53adca68_fri21cbb0dd.exe
- %TEMP%\7zscf2d2753\622bc53bf0d7c_fri21b3ac92dd.exe
- %TEMP%\7zscf2d2753\622bc53d6fbfe_fri21ed9c58.exe
- %TEMP%\7zscf2d2753\622bc56abbab1_fri21747a000248.exe
- %TEMP%\7zscf2d2753\622bc56c63ca6_fri21af10d0.exe
- %TEMP%\7zscf2d2753\622bc5375c71d_fri2119f1a6.exe
- %TEMP%\7zscf2d2753\622bc56ee82a5_fri212978899ca.exe
- %TEMP%\7zscf2d2753\622bc570aceb5_fri21932bc55.exe
- %TEMP%\7zscf2d2753\622bc572a291f_fri2192f4348924.exe
- %TEMP%\7zscf2d2753\libcurl.dll
- %TEMP%\7zscf2d2753\libcurlpp.dll
- %TEMP%\7zscf2d2753\libgcc_s_dw2-1.dll
- %TEMP%\7zscf2d2753\libstdc++-6.dll
- %TEMP%\7zscf2d2753\libwinpthread-1.dll
- %TEMP%\7zscf2d2753\622bc56ff1e7f_fri21501486eec0.exe
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\js\pad-nopadding.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\manifest.json
Deletes the following files
- %TEMP%\7zscf2d2753\622bc5363cc16_fri21e471f4.exe
- %TEMP%\is-26neh.tmp\idp.dll
- %TEMP%\is-26neh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-o7k0f.tmp\622bc53adca68_fri21cbb0dd.tmp
- %TEMP%\7zscf2d2753\622bc53bf0d7c_fri21b3ac92dd.exe
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\secure preferences
Network activity
Connects to
- 'ap###bstat.biz':80
- 'ic##eps.com':443
- 'yu########ma.s3.pl-waw.scw.cloud':80
- 'ip##pi.com':80
- 'v.###gamev.com':443
- 'microsoft.com':80
- 'ga####rsoftwera.com':80
- '92.##5.57.154':11841
- 'co###ctini.net':443
- 'ip###ger.org':443
- 'oo########ghts.s3.pl-waw.scw.cloud':443
TCP
HTTP GET requests
- http://ap###bstat.biz/stats/1.php?pu#######################
- http://yu########ma.s3.pl-waw.scw.cloud/adv-lookafter/poweroff.exe
- http://ip##pi.com/json/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ap###bstat.biz/info.php?pu########
- http://ap###bstat.biz/connection
HTTP POST requests
- http://ga####rsoftwera.com/?us#######
Other
- 'ic##eps.com':443
- 'v.###gamev.com':443
- 'co###ctini.net':443
- 'ip###ger.org':443
- 'yu########ma.s3.pl-waw.scw.cloud':443
UDP
- DNS ASK ap###bstat.biz
- DNS ASK ic##eps.com
- DNS ASK yu########ma.s3.pl-waw.scw.cloud
- DNS ASK ip##pi.com
- DNS ASK v.###gamev.com
- DNS ASK ge##hit.com
- DNS ASK microsoft.com
- DNS ASK ga####rsoftwera.com
- DNS ASK co###ctini.net
- DNS ASK ip###ger.org
- DNS ASK oo########ghts.s3.pl-waw.scw.cloud
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'ID' WindowName: ''
- ClassName: 'ObsidianGUI' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\7zscf2d2753\setup_install.exe'
- '%TEMP%\7zscf2d2753\622bc5375c71d_fri2119f1a6.exe'
- '%TEMP%\is-bsaev.tmp\5(6665____.exe' /S /UID=1405
- '%TEMP%\is-nb70k.tmp\622bc53adca68_fri21cbb0dd.tmp' /SL5="$20276,870458,780800,%TEMP%\7zSCF2D2753\622bc53adca68_Fri21cbb0dd.exe" /SILENT
- '%TEMP%\7zscf2d2753\622bc539162f8_fri218e20ca3f90.exe' -h
- '%TEMP%\7zscf2d2753\622bc53adca68_fri21cbb0dd.exe' /SILENT
- '%TEMP%\is-o7k0f.tmp\622bc53adca68_fri21cbb0dd.tmp' /SL5="$130148,870458,780800,%TEMP%\7zSCF2D2753\622bc53adca68_Fri21cbb0dd.exe"
- '%TEMP%\is-vgpqo.tmp\622bc56ff1e7f_fri21501486eec0.tmp' /SL5="$A0236,140006,56320,%TEMP%\7zSCF2D2753\622bc56ff1e7f_Fri21501486eec0.exe"
- '%TEMP%\7zscf2d2753\622bc570aceb5_fri21932bc55.exe'
- '%TEMP%\7zscf2d2753\622bc572a291f_fri2192f4348924.exe'
- '%TEMP%\7zscf2d2753\622bc56ee82a5_fri212978899ca.exe'
- '%TEMP%\7zscf2d2753\622bc56c63ca6_fri21af10d0.exe'
- '%TEMP%\7zscf2d2753\622bc539162f8_fri218e20ca3f90.exe'
- '%TEMP%\7zscf2d2753\622bc53adca68_fri21cbb0dd.exe'
- '%TEMP%\7zscf2d2753\622bc53bf0d7c_fri21b3ac92dd.exe'
- '%TEMP%\7zscf2d2753\622bc53d6fbfe_fri21ed9c58.exe'
- '%TEMP%\7zscf2d2753\622bc5383756b_fri2163d34f.exe'
- '%TEMP%\7zscf2d2753\622bc56ff1e7f_fri21501486eec0.exe'
- '%TEMP%\7zscf2d2753\622bc56abbab1_fri21747a000248.exe' /mixtwo
- '%TEMP%\is-bsaev.tmp\5(6665____.exe' /S /UID=1405' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL "%TEMP%\yHJo0y.cpL",
- '%WINDIR%\syswow64\control.exe' "%TEMP%\yHJo0y.cpL",
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\cmd.exe' /c 622bc572a291f_Fri2192f4348924.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc56ff1e7f_Fri21501486eec0.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc56c63ca6_Fri21af10d0.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc53bf0d7c_Fri21b3ac92dd.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc570aceb5_Fri21932bc55.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc56ee82a5_Fri212978899ca.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc56abbab1_Fri21747a000248.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 622bc53d6fbfe_Fri21ed9c58.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc539162f8_Fri218e20ca3f90.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc53adca68_Fri21cbb0dd.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc5383756b_Fri2163d34f.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc5375c71d_Fri2119f1a6.exe
- '%WINDIR%\syswow64\cmd.exe' /c 622bc5363cc16_Fri21e471f4.exe
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL "%TEMP%\yHJo0y.cpL",
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
