Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Modifies file system
Creates the following files
- nul
- %WINDIR%\temp\tarcac9.tmp
- %WINDIR%\temp\cabcab8.tmp
- %WINDIR%\temp\tarb544.tmp
- %WINDIR%\temp\cabb543.tmp
- %WINDIR%\temp\tarb503.tmp
- %WINDIR%\temp\cabb502.tmp
- %WINDIR%\temp\tar9fbd.tmp
- %WINDIR%\temp\cab9fbc.tmp
- %WINDIR%\temp\tar9f0f.tmp
- %WINDIR%\temp\cab9f0e.tmp
- %WINDIR%\temp\tar899a.tmp
- %WINDIR%\temp\cab8999.tmp
- %WINDIR%\temp\tar894a.tmp
- %WINDIR%\temp\cabe7d.tmp
- %WINDIR%\temp\cab8949.tmp
- %WINDIR%\temp\cab7376.tmp
- %WINDIR%\temp\tar7327.tmp
- %WINDIR%\temp\cab7326.tmp
- %WINDIR%\temp\tar72b8.tmp
- %WINDIR%\temp\cab72b7.tmp
- %WINDIR%\temp\tar7249.tmp
- %WINDIR%\temp\cab7248.tmp
- %WINDIR%\temp\tar5cf3.tmp
- %WINDIR%\temp\cab5cf2.tmp
- %WINDIR%\temp\tar5ca3.tmp
- %WINDIR%\temp\cab5ca2.tmp
- %WINDIR%\temp\tar4692.tmp
- %WINDIR%\temp\cab4691.tmp
- %WINDIR%\temp\tar7377.tmp
- %WINDIR%\temp\tare7e.tmp
Deletes the following files
- %WINDIR%\temp\cab4691.tmp
- %WINDIR%\temp\tarcac9.tmp
- %WINDIR%\temp\cabcab8.tmp
- %WINDIR%\temp\tarb544.tmp
- %WINDIR%\temp\cabb543.tmp
- %WINDIR%\temp\tarb503.tmp
- %WINDIR%\temp\cabb502.tmp
- %WINDIR%\temp\tar9fbd.tmp
- %WINDIR%\temp\cab9fbc.tmp
- %WINDIR%\temp\tar9f0f.tmp
- %WINDIR%\temp\cab9f0e.tmp
- %WINDIR%\temp\tar899a.tmp
- %WINDIR%\temp\cab8999.tmp
- %WINDIR%\temp\tar894a.tmp
- %WINDIR%\temp\cab8949.tmp
- %WINDIR%\temp\tar7377.tmp
- %WINDIR%\temp\cab7376.tmp
- %WINDIR%\temp\tar7327.tmp
- %WINDIR%\temp\cab7326.tmp
- %WINDIR%\temp\tar72b8.tmp
- %WINDIR%\temp\cab72b7.tmp
- %WINDIR%\temp\tar7249.tmp
- %WINDIR%\temp\cab7248.tmp
- %WINDIR%\temp\tar5cf3.tmp
- %WINDIR%\temp\cab5cf2.tmp
- %WINDIR%\temp\tar5ca3.tmp
- %WINDIR%\temp\cab5ca2.tmp
- %WINDIR%\temp\tar4692.tmp
- %WINDIR%\temp\cabe7d.tmp
- %WINDIR%\temp\tare7e.tmp
Network activity
Connects to
- 'localhost':49181
- 'localhost':49183
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49181
- 'localhost':49183
- 'localhost':49184
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'Everything'
- ClassName: '' WindowName: 'Detect It Easy v3.01'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x64 v0.9.8'
- ClassName: '' WindowName: 'Scylla x86 v0.9.8'
- ClassName: '' WindowName: 'FiddlerCore'
- ClassName: '' WindowName: 'FiddlerCap'
- ClassName: '' WindowName: 'Fiddler Jam'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'Fiddler Classic'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x64DBG'
- ClassName: '' WindowName: 'x32DBG'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'Cheat Engine 7.3'
- ClassName: '' WindowName: 'Cheat Engine 7.4'
- ClassName: '' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'Snowman'
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
