Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\ctfmon.exe
the following user processes:
- chrome.exe
- msedge.exe
- firefox.exe
Intercepts control using hardware breakpoints
in NTDLL dll
- ctfmon.exe process, ntdll.dll module
- firefox.exe process, ntdll.dll module
- msedge.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\etilqs_aglowdszmc9gpp4
- %TEMP%\etilqs_9yddhnntth3zv15
- %TEMP%\etilqs_nnyhs8nilaz38go
Network activity
Connects to
- 'le#####kalgklagl.com':8443
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
TCP
Other
- 'le#####kalgklagl.com':8443
- 'google.com':443
- 'clients2.google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'gs##tic.com':443
UDP
- DNS ASK le#####kalgklagl.com
- DNS ASK google.com
- DNS ASK clients4.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients2.google.com
- DNS ASK clients3.google.com
- DNS ASK ss#.#static.com
- DNS ASK gs##tic.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '<SYSTEM32>\ctfmon.exe'
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe'
