Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0] 'ImagePath' = '<DRIVERS>\WinRing0.sys'
Creates the following services
- 'WinRing0' <DRIVERS>\WinRing0.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <DRIVERS>\winring0.sys
Network activity
Connects to
- 'co#####rg7.pages.dev':443
- 'so######copapool.pages.dev':443
- 'xm#####a1.nanopool.org':10343
TCP
Other
- 'so######copapool.pages.dev':443
- 'co#####rg7.pages.dev':443
- 'xm#####a1.nanopool.org':10343
UDP
- DNS ASK so######copapool.pages.dev
- DNS ASK co#####rg7.pages.dev
- DNS ASK xm#####a1.nanopool.org
Miscellaneous
Executes the following
- '%WINDIR%\explorer.exe' -a rx/0 -o xmr-asia1.nanopool.org:10343 --keepalive -u 48LzVEivaesa8kHDbpU3BiLX9wiv11GdNB4Ji6PVZFWB5fMFvZTrqRn5bUo2VRB7oAQDvHztzx5Ma8WHWKHevK8A6smyppv -p x --tls --cpu-max-threads-hint=40
- '%WINDIR%\explorer.exe' -a rx/0 -o xmr-asia1.nanopool.org:10343 --keepalive -u 48LzVEivaesa8kHDbpU3BiLX9wiv11GdNB4Ji6PVZFWB5fMFvZTrqRn5bUo2VRB7oAQDvHztzx5Ma8WHWKHevK8A6smyppv -p x --tls --cpu-max-threads-hint=40' (with hidden window)
