Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_8a9159a9cba54c36881bf54a78674b63.zip
- %TEMP%\rmm_update_2ecee16ffc3d4575ab8cdea06ae1597d\windowsservicehost.exe
- %TEMP%\rmm_update_2ecee16ffc3d4575ab8cdea06ae1597d\rmm.agent.console.exe
- %TEMP%\rmm_update_2ecee16ffc3d4575ab8cdea06ae1597d\appsettings.json
- %TEMP%\rmm_update_2ecee16ffc3d4575ab8cdea06ae1597d\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\bb5e425972fe42b2a836310d46b33167.ps1
- %TEMP%\rmm_update_7c59e1a17526473eb567108fe4742e9b.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>.rollback\<File name>.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_d4089b3a5ca24f44af511d4bfb4328e9.zip
- %TEMP%\rmm_update_5744190b03264925941a39be3a115968\windowsservicehost.exe
- %TEMP%\rmm_update_5744190b03264925941a39be3a115968\rmm.agent.console.exe
- %TEMP%\rmm_update_5744190b03264925941a39be3a115968\appsettings.json
- %TEMP%\rmm_update_5744190b03264925941a39be3a115968\vcruntime140.dll
- %TEMP%\78edc8c1a6a6415384291921a1ca67d5.ps1
- %TEMP%\rmm_update_c98c8bdec44e4915ae831c978cc6dd15.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_71c8c586ffac4a74bfdb871496e88c2e.zip
- %TEMP%\rmm_update_3c334915a3d1410cb454f4a2ada7c160\windowsservicehost.exe
- %TEMP%\rmm_update_3c334915a3d1410cb454f4a2ada7c160\rmm.agent.console.exe
- %TEMP%\rmm_update_3c334915a3d1410cb454f4a2ada7c160\appsettings.json
- %TEMP%\rmm_update_3c334915a3d1410cb454f4a2ada7c160\vcruntime140.dll
- %TEMP%\70cf7d03adcf4167b91659ab14051c2c.ps1
- %TEMP%\rmm_update_bff9e2e608d7424fbf293bccef57e1e1.bat
- %TEMP%\rmm_update_235ea2fe3c334f36a5994c71edc73a18.zip
- %TEMP%\rmm_update_4ab250a2b7884430878f895b727f67d6\windowsservicehost.exe
- %TEMP%\rmm_update_4ab250a2b7884430878f895b727f67d6\rmm.agent.console.exe
- %TEMP%\rmm_update_4ab250a2b7884430878f895b727f67d6\appsettings.json
- %TEMP%\rmm_update_4ab250a2b7884430878f895b727f67d6\vcruntime140.dll
- %TEMP%\f2de922d0ab74c1ba622e214dfeae163.ps1
- %TEMP%\rmm_update_8d108b6ac0ed42088623d337141fa360.bat
- %TEMP%\rmm_update_1c56a31ec53641db8e23c3a8fd72aa85.zip
- %TEMP%\rmm_update_f7c996b1fced4d1fb3d21a7d80cd90ea\windowsservicehost.exe
- %TEMP%\rmm_update_f7c996b1fced4d1fb3d21a7d80cd90ea\rmm.agent.console.exe
- %TEMP%\rmm_update_f7c996b1fced4d1fb3d21a7d80cd90ea\appsettings.json
- %TEMP%\rmm_update_f7c996b1fced4d1fb3d21a7d80cd90ea\vcruntime140.dll
- %TEMP%\b0c70b3452e34a0dab1e2a3319a09334.ps1
- %TEMP%\rmm_update_0143c295d06c42e9a482557061e53e57.bat
Deletes following files that it created itself
- %TEMP%\bb5e425972fe42b2a836310d46b33167.ps1
- %TEMP%\78edc8c1a6a6415384291921a1ca67d5.ps1
- %TEMP%\70cf7d03adcf4167b91659ab14051c2c.ps1
- %TEMP%\f2de922d0ab74c1ba622e214dfeae163.ps1
- %TEMP%\b0c70b3452e34a0dab1e2a3319a09334.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\bb5e425972fe42b2a836310d46b33167.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\78edc8c1a6a6415384291921a1ca67d5.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\70cf7d03adcf4167b91659ab14051c2c.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\f2de922d0ab74c1ba622e214dfeae163.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\b0c70b3452e34a0dab1e2a3319a09334.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7c59e1a17526473eb567108fe4742e9b.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_2ecee16ffc3d4575ab8cdea06ae1597d\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_c98c8bdec44e4915ae831c978cc6dd15.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_5744190b03264925941a39be3a115968\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bff9e2e608d7424fbf293bccef57e1e1.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_3c334915a3d1410cb454f4a2ada7c160\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_8d108b6ac0ed42088623d337141fa360.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_4ab250a2b7884430878f895b727f67d6\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0143c295d06c42e9a482557061e53e57.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_f7c996b1fced4d1fb3d21a7d80cd90ea\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\c981ac5bc87142388a8f1cec7475b173.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_9eaf24249f264cfaae30b183adb31248.bat"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7c59e1a17526473eb567108fe4742e9b.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_c98c8bdec44e4915ae831c978cc6dd15.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bff9e2e608d7424fbf293bccef57e1e1.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_8d108b6ac0ed42088623d337141fa360.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0143c295d06c42e9a482557061e53e57.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_9eaf24249f264cfaae30b183adb31248.bat"' (with hidden window)
