Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_d290f41343d04dfda0d9b7e1c6cb8179.zip
- %TEMP%\rmm_update_ff8b1bf7e4e64a668a9404eb5a6d868b\windowsservicehost.exe
- %TEMP%\rmm_update_ff8b1bf7e4e64a668a9404eb5a6d868b\rmm.agent.console.exe
- %TEMP%\rmm_update_ff8b1bf7e4e64a668a9404eb5a6d868b\appsettings.json
- %TEMP%\rmm_update_ff8b1bf7e4e64a668a9404eb5a6d868b\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\72e6727d04db47368c5145929186b906.ps1
- %TEMP%\rmm_update_4cc3c2ac73c44b2caa4225d4e52e0dd3.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>.rollback\<File name>.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_95f0a3addf3e43f28d7f442202ddab39.zip
- %TEMP%\rmm_update_185fa678eb824e109461dbcea20f121b\windowsservicehost.exe
- %TEMP%\rmm_update_185fa678eb824e109461dbcea20f121b\rmm.agent.console.exe
- %TEMP%\rmm_update_185fa678eb824e109461dbcea20f121b\appsettings.json
- %TEMP%\rmm_update_185fa678eb824e109461dbcea20f121b\vcruntime140.dll
- %TEMP%\37e17d0a7349479ebca77da98abec27d.ps1
- %TEMP%\rmm_update_40ad89e8fbd54cc49c88d67e34559710.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_14c67929ee8a48898713e62a38abe973.zip
- %TEMP%\rmm_update_27b2308f9d3e46ada9fd922cb1b9352f\windowsservicehost.exe
- %TEMP%\rmm_update_27b2308f9d3e46ada9fd922cb1b9352f\rmm.agent.console.exe
- %TEMP%\rmm_update_27b2308f9d3e46ada9fd922cb1b9352f\appsettings.json
- %TEMP%\rmm_update_27b2308f9d3e46ada9fd922cb1b9352f\vcruntime140.dll
- %TEMP%\d31749c876a74b91a0d5f0e2a3997943.ps1
- %TEMP%\rmm_update_6ee0a6dd3bdc4a13bdeb9dccf893fbcf.bat
- %TEMP%\rmm_update_db593ed7ad324cebb07a976403aa6619.zip
Deletes following files that it created itself
- %TEMP%\72e6727d04db47368c5145929186b906.ps1
- %TEMP%\37e17d0a7349479ebca77da98abec27d.ps1
- %TEMP%\d31749c876a74b91a0d5f0e2a3997943.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\72e6727d04db47368c5145929186b906.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\37e17d0a7349479ebca77da98abec27d.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\d31749c876a74b91a0d5f0e2a3997943.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_4cc3c2ac73c44b2caa4225d4e52e0dd3.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_ff8b1bf7e4e64a668a9404eb5a6d868b\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_40ad89e8fbd54cc49c88d67e34559710.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_185fa678eb824e109461dbcea20f121b\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_6ee0a6dd3bdc4a13bdeb9dccf893fbcf.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_27b2308f9d3e46ada9fd922cb1b9352f\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\07a56e890d1b49d0ab0fa95e1e12896c.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_60e9f78573714b10a9f4fdd5683a8289.bat"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_4cc3c2ac73c44b2caa4225d4e52e0dd3.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_40ad89e8fbd54cc49c88d67e34559710.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_6ee0a6dd3bdc4a13bdeb9dccf893fbcf.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_60e9f78573714b10a9f4fdd5683a8289.bat"' (with hidden window)
