Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\xmrig.lnk
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\WinRing0x64.sys
Modifies file system
Creates the following files
- %APPDATA%\safecore.exe
- nul
- <SYSTEM32>\windowspowershell\v1.0\xmrig.log
Network activity
Connects to
- 'gu##.##neroocean.stream':10001
TCP
Other
- 'gu##.##neroocean.stream':10001
- '15#.#01.1.91':443
UDP
- DNS ASK gu##.##neroocean.stream
Miscellaneous
Creates and executes the following
- '%APPDATA%\safecore.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C timeout /t 2 >NUL & del /f /q "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 2
- '%APPDATA%\safecore.exe' ' (with hidden window)
