Technical Information
To ensure autorun and distribution
Creates the following services
- 'UserUpdateSvc' %TEMP%\svchost_1770509843.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\svchost_1770509843.exe
- nul
Network activity
Connects to
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost_1770509843.exe'
Executes the following
- '%WINDIR%\syswow64\sc.exe' create UserUpdateSvc binPath= %TEMP%\svchost_1770509843.exe start= auto obj= .\\LocalSystem
- '%WINDIR%\syswow64\cmdkey.exe' /list
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles
- '%TEMP%\svchost_1770509843.exe' ' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create UserUpdateSvc binPath= %TEMP%\svchost_1770509843.exe start= auto obj= .\\LocalSystem' (with hidden window)
- '%WINDIR%\syswow64\cmdkey.exe' /list' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles' (with hidden window)
