Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Environment] 'UserInitMprLogonScript' = '%LOCALAPPDATA%\Microsoft\Temp\A059EE23\SoftAgent339820.exe'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\temp\a059ee23\softagent339820.exe
Deletes itself.
Network activity
Connects to
- 'po########innet.gateway.tatum.io':443
- 'x1.#.lencr.org':80
- 'ga####y.tenderly.co':443
- 'me####.gardenpark.click':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'po########innet.gateway.tatum.io':443
- 'ga####y.tenderly.co':443
- 'me####.gardenpark.click':443
UDP
- DNS ASK da##.#spenbox.lat
- DNS ASK po########innet.gateway.tatum.io
- DNS ASK x1.#.lencr.org
- DNS ASK ga####y.tenderly.co
- DNS ASK me####.gardenpark.click
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\temp\a059ee23\softagent339820.exe'
Executes the following
- '%LOCALAPPDATA%\microsoft\temp\a059ee23\softagent339820.exe' ' (with hidden window)
