Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Mesh Agent] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Mesh Agent] 'ImagePath' = '"%ProgramFiles(x86)%\Windows.NET\meshagent64.exe"'
- [HKLM\SYSTEM\CurrentControlSet\Services\Mesh Agent] 'ImagePath' = '"%ProgramFiles(x86)%\Windows.NET\meshagent64.exe" --installedByUser="S-1-5-21-4226853953-3309226944-3078887307-1000"'
Creates the following services
- 'Mesh Agent' %ProgramFiles(x86)%\Windows.NET\meshagent64.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM meshagent64.exe
Modifies file system
Creates the following files
- %TEMP%\is-4cqfpie7ja.tmp\<File name>.tmp
- %TEMP%\is-fctpt68nfk.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\windows.net\is-stles8rl63.tmp
- %ProgramFiles(x86)%\windows.net\meshagent64.msh
- %ProgramFiles(x86)%\windows.net\meshagent64.db
- nul
- %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\8b4bb76343abb41b06ce4b46a614f4e1_8cf7b530-613e-439b-a8c5-ccfc0e745400
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\systemcertificates\my\certificates\060be74bfd34592523e9cda322d916636269e907
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\systemcertificates\my\keys\1a03dcbd92e11f3ba1a77810ccc37ebe4841f341
- %ProgramFiles(x86)%\windows.net\meshagent64.log
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\systemcertificates\my\certificates\6b2da67b9d81ae8066547c742b10e494b1f2b3c8
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\systemcertificates\my\keys\651dbd0e89fea87d2d41473d2be26ec3c14400a3
- %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\2b79ee980b2ca5b7b7f99d5172da7dd2_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %WINDIR%\temp\__psscriptpolicytest_q4sbn1ye.hhs.ps1
- %WINDIR%\temp\__psscriptpolicytest_j5uq4nbf.5yn.psm1
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-48-339.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-49-190.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-50-125.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-50-194.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-50-348.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-50-448.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-55-471.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-55-518.dump
- %WINDIR%\temp\content\2768-3224-powershell.exe-21-27-57-197.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-interactive
- %ProgramFiles(x86)%\windows.net\meshagent64.db.tmp
Deletes following files that it created itself
- %TEMP%\is-fctpt68nfk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4cqfpie7ja.tmp\<File name>.tmp
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\systemcertificates\my\certificates\060be74bfd34592523e9cda322d916636269e907
- %WINDIR%\temp\__psscriptpolicytest_q4sbn1ye.hhs.ps1
- %WINDIR%\temp\__psscriptpolicytest_j5uq4nbf.5yn.psm1
- %ProgramFiles(x86)%\windows.net\meshagent64.db.tmp
Moves the following files
- from %ProgramFiles(x86)%\windows.net\is-stles8rl63.tmp to %ProgramFiles(x86)%\windows.net\meshagent64.exe
Network activity
Connects to
- 'x.####the.qzz.io':443
TCP
Other
- 'x.####the.qzz.io':443
UDP
- DNS ASK x.####the.qzz.io
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-4cqfpie7ja.tmp\<File name>.tmp' /SL5="$1102C4,2550859,1097216,<Full path to file>"
- '%ProgramFiles(x86)%\windows.net\meshagent64.exe' -install --silent
- '%ProgramFiles(x86)%\windows.net\meshagent64.exe' --installedByUser="S-1-5-21-4226853953-3309226944-3078887307-1000"
- '%ProgramFiles(x86)%\windows.net\meshagent64.exe' -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRT...
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C timeout /t 5 /nobreak > nul & del "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' /t 5 /nobreak
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noprofile -nologo -command -
- '%WINDIR%\syswow64\taskkill.exe' /F /IM meshagent64.exe' (with hidden window)
- '%ProgramFiles(x86)%\windows.net\meshagent64.exe' -install --silent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C timeout /t 5 /nobreak > nul & del "<Full path to file>"' (with hidden window)
