Technical Information
Malicious functions
Injects code into
the following user processes:
- msedge.exe
Patches code
in NTDLL dll
- mkuaqwor.exe process, ntdll.dll module
- msedge.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\lagofast.log
- %TEMP%\87c68d01.dll
- %TEMP%\etilqs_z8rgogjw66nbtyi
- %TEMP%\etilqs_oka1wlzsnfictii
- %TEMP%\etilqs_ju1loitxky4wzwy
- %TEMP%\7a94bffd.dll
- %TEMP%\payload_5016.log
- %TEMP%\elevator_5016.log
- %TEMP%\screenshot.bmp
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\ld_default.db
- %TEMP%\pw_5016.log
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\wd_default.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\hi_default.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\screenshot.bmp
- %TEMP%\steam_debug.txt
- %TEMP%\steam_localvdf_debug.txt
- %TEMP%\discord_debug.txt
- %TEMP%\epic_config_debug.txt
- %TEMP%\google_token_dbg.txt
- %TEMP%\gt_wd_1932561606016.db
- %TEMP%\gt_wd_1932561606400.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\edge\gmailtokens.txt
- %TEMP%\microsoft_token_dbg.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\0_kontakty.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\1_containers.json
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\2_default_partner_content.json
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\3_mailviews.dat
- %TEMP%\battlenet_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\device_info.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\battlenet_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\discord_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\google_token_dbg.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\steam_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\steam_localvdf_debug.txt
Deletes following files that it created itself
- %TEMP%\7a94bffd.dll
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\ld_default.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\wd_default.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\hi_default.db
- %TEMP%\screenshot.bmp
- %TEMP%\gt_wd_1932561606016.db
- %TEMP%\gt_wd_1932561606400.db
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\battlenet_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\discord_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\google_token_dbg.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\steam_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\debug_logs\steam_localvdf_debug.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\device_info.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\edge\gmailtokens.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\0_kontakty.txt
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\1_containers.json
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\2_default_partner_content.json
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\passwordfiles\3_mailviews.dat
- %TEMP%\ax_19a897e0-d936-43bb-9739-ac99caf18a14\screenshot.bmp
Modifies the following files
- %LOCALAPPDATA%\google\chrome\application\debug.log
Network activity
Connects to
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'p4#.#uckdns.org':5000
TCP
Other
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'clients3.google.com':443
- 'ss#.#static.com':443
UDP
- DNS ASK google.com
- DNS ASK clients4.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients3.google.com
- DNS ASK ss#.#static.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK p4#.#uckdns.org
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-first-run --disable-extensions --window-position=-32000,-32000 --disable-features=RendererCodeIntegrity,DynamicCodeSettings --no-sandbox
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --no-first-run --disable-extensions --window-position=-32000,-32000 --disable-features=RendererCodeIntegrity,DynamicCodeSettings --no-sandbox' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-first-run --disable-extensions --window-position=-32000,-32000 --disable-features=RendererCodeIntegrity,DynamicCodeSettings --no-sandbox' (with hidden window)
