Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\NvStreamKmd_dcrcv] 'ImagePath' = '%WINDIR%\Temp\DCRCVDrv.sys'
Creates the following services
- 'NvStreamKmd_dcrcv' %WINDIR%\Temp\DCRCVDrv.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthservice.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\dcrcvdrv.sys
Network activity
Connects to
- 'ak####verstall.top':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'ye.#.lencr.org':80
- 'ye#.#.lencr.org':80
TCP
HTTP GET requests
- http://x2.#.lencr.org/
- http://ye.#.lencr.org/
- http://ye#.#.lencr.org/51.crl
Other
- 'ak####verstall.top':443
UDP
- DNS ASK ak####verstall.top
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK ye.#.lencr.org
- DNS ASK ye#.#.lencr.org
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe'
- '<SYSTEM32>\securityhealthservice.exe'
