Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_f6149deb9f7a4cf884f16711d279dcb0.zip
- %TEMP%\rmm_update_92d7466239c746aca45fbd2799884e76\windowsservicehost.exe
- %TEMP%\rmm_update_92d7466239c746aca45fbd2799884e76\rmm.agent.console.exe
- %TEMP%\rmm_update_92d7466239c746aca45fbd2799884e76\appsettings.json
- %TEMP%\rmm_update_92d7466239c746aca45fbd2799884e76\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\e7efe7be8c3a4a57a697b71389b3bc39.ps1
- %TEMP%\rmm_update_bcffa1bc83e0494f97843b02c077dcc9.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\<File name>.exe
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_f2e238490943478483680514bb10f61f.zip
- %TEMP%\rmm_update_a9bafd443c4e454f90e607394e84407e\windowsservicehost.exe
- %TEMP%\rmm_update_a9bafd443c4e454f90e607394e84407e\rmm.agent.console.exe
- %TEMP%\rmm_update_a9bafd443c4e454f90e607394e84407e\appsettings.json
- %TEMP%\rmm_update_a9bafd443c4e454f90e607394e84407e\vcruntime140.dll
- %TEMP%\35a3ac0294dc4531a9fc6a20cc3a4d8f.ps1
- %TEMP%\rmm_update_7db4f402effe4e0c800c236c1eeaea89.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_a8144a925c0c4378818cb4094157936e.zip
- %TEMP%\rmm_update_e1d52000275b4caf987210b8f72577ef\windowsservicehost.exe
- %TEMP%\rmm_update_e1d52000275b4caf987210b8f72577ef\rmm.agent.console.exe
- %TEMP%\rmm_update_e1d52000275b4caf987210b8f72577ef\appsettings.json
- %TEMP%\rmm_update_e1d52000275b4caf987210b8f72577ef\vcruntime140.dll
- %TEMP%\2a251ab00aaf4960a75e02a3f944c46c.ps1
- %TEMP%\rmm_update_d691e1b25f974010814ed7d453cc604a.bat
- %TEMP%\rmm_update_bdfe3b99060d49a7b2ffc9c8140fe98b.zip
- %TEMP%\rmm_update_11866ac327cf404685ef1ceff48c9b96\windowsservicehost.exe
- %TEMP%\rmm_update_11866ac327cf404685ef1ceff48c9b96\rmm.agent.console.exe
- %TEMP%\rmm_update_11866ac327cf404685ef1ceff48c9b96\appsettings.json
- %TEMP%\rmm_update_11866ac327cf404685ef1ceff48c9b96\vcruntime140.dll
- %TEMP%\be45a6310fe14176a11abe7afa8fa99d.ps1
Deletes following files that it created itself
- %TEMP%\e7efe7be8c3a4a57a697b71389b3bc39.ps1
- %TEMP%\35a3ac0294dc4531a9fc6a20cc3a4d8f.ps1
- %TEMP%\2a251ab00aaf4960a75e02a3f944c46c.ps1
- %TEMP%\be45a6310fe14176a11abe7afa8fa99d.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\e7efe7be8c3a4a57a697b71389b3bc39.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\35a3ac0294dc4531a9fc6a20cc3a4d8f.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\2a251ab00aaf4960a75e02a3f944c46c.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\be45a6310fe14176a11abe7afa8fa99d.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bcffa1bc83e0494f97843b02c077dcc9.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_92d7466239c746aca45fbd2799884e76\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7db4f402effe4e0c800c236c1eeaea89.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_a9bafd443c4e454f90e607394e84407e\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d691e1b25f974010814ed7d453cc604a.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_e1d52000275b4caf987210b8f72577ef\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_8384103c20804ac2a92998c6e7b992c5.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_11866ac327cf404685ef1ceff48c9b96\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\8e92aa5f5aa3443ba8e47a33c54d4138.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_bcffa1bc83e0494f97843b02c077dcc9.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_7db4f402effe4e0c800c236c1eeaea89.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d691e1b25f974010814ed7d453cc604a.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_8384103c20804ac2a92998c6e7b992c5.bat"' (with hidden window)
