Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- nul
- %WINDIR%\temp\tar4a35.tmp
- %WINDIR%\temp\cab4a34.tmp
- %WINDIR%\temp\tar353c.tmp
- %WINDIR%\temp\cab353b.tmp
- %WINDIR%\temp\tar350b.tmp
- %WINDIR%\temp\cab350a.tmp
- %WINDIR%\temp\tar1f87.tmp
- %WINDIR%\temp\cab1f86.tmp
- %WINDIR%\temp\tar1f46.tmp
- %WINDIR%\temp\cab1f45.tmp
- %WINDIR%\temp\tara4e.tmp
- %WINDIR%\temp\caba4d.tmp
- %WINDIR%\temp\tara1d.tmp
- %WINDIR%\temp\cab8cc1.tmp
- %WINDIR%\temp\caba1c.tmp
- %WINDIR%\temp\cabf459.tmp
- %WINDIR%\temp\tarf429.tmp
- %WINDIR%\temp\cabf428.tmp
- %WINDIR%\temp\tarf3f8.tmp
- %WINDIR%\temp\cabf3f7.tmp
- %WINDIR%\temp\tarf3b8.tmp
- %WINDIR%\temp\cabf3b7.tmp
- %WINDIR%\temp\tarde90.tmp
- %WINDIR%\temp\cabde8f.tmp
- %WINDIR%\temp\tarde60.tmp
- %WINDIR%\temp\cabde5f.tmp
- %WINDIR%\temp\tarc8ac.tmp
- %WINDIR%\temp\cabc8ab.tmp
- %WINDIR%\temp\tarf45a.tmp
- %WINDIR%\temp\tar8cc2.tmp
Deletes the following files
- %WINDIR%\temp\cabc8ab.tmp
- %WINDIR%\temp\tar4a35.tmp
- %WINDIR%\temp\cab4a34.tmp
- %WINDIR%\temp\tar353c.tmp
- %WINDIR%\temp\cab353b.tmp
- %WINDIR%\temp\tar350b.tmp
- %WINDIR%\temp\cab350a.tmp
- %WINDIR%\temp\tar1f87.tmp
- %WINDIR%\temp\cab1f86.tmp
- %WINDIR%\temp\tar1f46.tmp
- %WINDIR%\temp\cab1f45.tmp
- %WINDIR%\temp\tara4e.tmp
- %WINDIR%\temp\caba4d.tmp
- %WINDIR%\temp\tara1d.tmp
- %WINDIR%\temp\caba1c.tmp
- %WINDIR%\temp\tarf45a.tmp
- %WINDIR%\temp\cabf459.tmp
- %WINDIR%\temp\tarf429.tmp
- %WINDIR%\temp\cabf428.tmp
- %WINDIR%\temp\tarf3f8.tmp
- %WINDIR%\temp\cabf3f7.tmp
- %WINDIR%\temp\tarf3b8.tmp
- %WINDIR%\temp\cabf3b7.tmp
- %WINDIR%\temp\tarde90.tmp
- %WINDIR%\temp\cabde8f.tmp
- %WINDIR%\temp\tarde60.tmp
- %WINDIR%\temp\cabde5f.tmp
- %WINDIR%\temp\tarc8ac.tmp
- %WINDIR%\temp\cab8cc1.tmp
- %WINDIR%\temp\tar8cc2.tmp
Network activity
Connects to
- 'localhost':49185
- 'localhost':49187
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'Everything'
- ClassName: '' WindowName: 'Detect It Easy v3.01'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x64 v0.9.8'
- ClassName: '' WindowName: 'Scylla x86 v0.9.8'
- ClassName: '' WindowName: 'FiddlerCore'
- ClassName: '' WindowName: 'FiddlerCap'
- ClassName: '' WindowName: 'Fiddler Jam'
- ClassName: '' WindowName: 'Fiddler Classic'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x32DBG'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'Cheat Engine 7.3'
- ClassName: '' WindowName: 'Cheat Engine 7.4'
- ClassName: '' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'x64DBG'
- ClassName: '' WindowName: 'Snowman'
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
