Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_67ad80f67b9f42b497fb2da23e9cf242.zip
- %TEMP%\rmm_update_d900de50c29443d780dd0936eacc1ea4\windowsservicehost.exe
- %TEMP%\rmm_update_d900de50c29443d780dd0936eacc1ea4\rmm.agent.console.exe
- %TEMP%\rmm_update_d900de50c29443d780dd0936eacc1ea4\appsettings.json
- %TEMP%\rmm_update_d900de50c29443d780dd0936eacc1ea4\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\c3083454f3954825b650e116363c40c8.ps1
- %TEMP%\rmm_update_7a7d96b381c749a1949374afcd4a3dd4.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\<File name>.exe
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_5d09f200773846ac878941b9a3a55722.zip
- %TEMP%\rmm_update_ff36305c27384aea9ef72d4cbbbf9a13\windowsservicehost.exe
- %TEMP%\rmm_update_ff36305c27384aea9ef72d4cbbbf9a13\rmm.agent.console.exe
- %TEMP%\rmm_update_ff36305c27384aea9ef72d4cbbbf9a13\appsettings.json
- %TEMP%\rmm_update_ff36305c27384aea9ef72d4cbbbf9a13\vcruntime140.dll
- %TEMP%\786dbedb6b304286904d72289ef010c2.ps1
- %TEMP%\rmm_update_4ee3761e78df4b54be597ad15628c15f.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_e7e3204d6e074c459a6e5a3af8474917.zip
- %TEMP%\rmm_update_9e5f14b9a33340658bbe5e525a43543f\windowsservicehost.exe
- %TEMP%\rmm_update_9e5f14b9a33340658bbe5e525a43543f\rmm.agent.console.exe
- %TEMP%\rmm_update_9e5f14b9a33340658bbe5e525a43543f\appsettings.json
- %TEMP%\rmm_update_9e5f14b9a33340658bbe5e525a43543f\vcruntime140.dll
- %TEMP%\0d716b627d974703a122742650e853ab.ps1
- %TEMP%\rmm_update_2dc5a82cbb0e48d283cdffdaff451b52.bat
- %TEMP%\rmm_update_84a5173dd8dc43c898d44c68b0ffe84e.zip
- %TEMP%\rmm_update_7bac1ef3a6a24e89870d0f77957b9b25\windowsservicehost.exe
- %TEMP%\rmm_update_7bac1ef3a6a24e89870d0f77957b9b25\rmm.agent.console.exe
- %TEMP%\rmm_update_7bac1ef3a6a24e89870d0f77957b9b25\appsettings.json
- %TEMP%\rmm_update_7bac1ef3a6a24e89870d0f77957b9b25\vcruntime140.dll
- %TEMP%\d600f993e4984cea9475f6c3c8322f96.ps1
- %TEMP%\rmm_update_eaa0fc9311f44c18a2d5153cd54c8709.bat
- %TEMP%\rmm_update_57b067f4a6774219b398bfb61030d0d7.zip
- %TEMP%\rmm_update_4d3504eb3428488e9077e6c9c0985da6\windowsservicehost.exe
- %TEMP%\rmm_update_4d3504eb3428488e9077e6c9c0985da6\rmm.agent.console.exe
- %TEMP%\rmm_update_4d3504eb3428488e9077e6c9c0985da6\appsettings.json
- %TEMP%\rmm_update_4d3504eb3428488e9077e6c9c0985da6\vcruntime140.dll
- %TEMP%\0381960470e3469680915e6f50987c6a.ps1
Deletes following files that it created itself
- %TEMP%\c3083454f3954825b650e116363c40c8.ps1
- %TEMP%\786dbedb6b304286904d72289ef010c2.ps1
- %TEMP%\0d716b627d974703a122742650e853ab.ps1
- %TEMP%\d600f993e4984cea9475f6c3c8322f96.ps1
- %TEMP%\0381960470e3469680915e6f50987c6a.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\c3083454f3954825b650e116363c40c8.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\786dbedb6b304286904d72289ef010c2.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\0d716b627d974703a122742650e853ab.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\d600f993e4984cea9475f6c3c8322f96.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\0381960470e3469680915e6f50987c6a.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7a7d96b381c749a1949374afcd4a3dd4.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_d900de50c29443d780dd0936eacc1ea4\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_4ee3761e78df4b54be597ad15628c15f.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_ff36305c27384aea9ef72d4cbbbf9a13\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_2dc5a82cbb0e48d283cdffdaff451b52.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_9e5f14b9a33340658bbe5e525a43543f\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_eaa0fc9311f44c18a2d5153cd54c8709.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_7bac1ef3a6a24e89870d0f77957b9b25\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_3797a55aea08447c9a3a8ac6406f2941.bat"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7a7d96b381c749a1949374afcd4a3dd4.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_4ee3761e78df4b54be597ad15628c15f.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_2dc5a82cbb0e48d283cdffdaff451b52.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_eaa0fc9311f44c18a2d5153cd54c8709.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_3797a55aea08447c9a3a8ac6406f2941.bat"' (with hidden window)
