Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\defendnot
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Microsoft
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %WINDIR%
Injects code into
the following system processes:
- <SYSTEM32>\taskmgr.exe
- %WINDIR%\explorer.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\taskmgr.exe
Modifies file system
Creates the following files
- nul
- %WINDIR%\hcxni94j\defendnot-loader.pdb
- %WINDIR%\hcxni94j\defendnot.pdb
- %WINDIR%\hcxni94j\extra-strip.bat
- %WINDIR%\hcxni94j\defendnot.dll
- %WINDIR%\hcxni94j\defendnot-loader.exe
- %TEMP%\dn-3420900889.ps1
- %WINDIR%\hcxni94j\ctx.bin
- %LOCALAPPDATA%\microsoft\updater_tausxdrl.exe
Network activity
Connects to
- 'er#####wenmjibedi.cc':443
- 'x1.#.lencr.org':80
- 'ka#####lsystems.rest':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'er#####wenmjibedi.cc':443
- 'ka#####lsystems.rest':443
UDP
- DNS ASK er#####wenmjibedi.cc
- DNS ASK x1.#.lencr.org
- DNS ASK ka#####lsystems.rest
Miscellaneous
Creates and executes the following
- '%WINDIR%\hcxni94j\defendnot-loader.exe' --silent
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command %TEMP%\dn-3420900889.ps1
- '%LOCALAPPDATA%\microsoft\updater_tausxdrl.exe'
Executes the following
- '<SYSTEM32>\taskmgr.exe'
- '%WINDIR%\hcxni94j\defendnot-loader.exe' --silent' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command %TEMP%\dn-3420900889.ps1' (with hidden window)
- '%LOCALAPPDATA%\microsoft\updater_tausxdrl.exe' ' (with hidden window)
