Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdatetask
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Patches code
in NTDLL dll
- pdky.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\cye0e9ed17\corvus.vmp.exe
- %TEMP%\cye0e9ed17\vcruntime140.dll
- %TEMP%\cye0e9ed17\vcruntime140_1.dll
- %TEMP%\cye0e9ed17\msvcp140.dll
- %TEMP%\cye0e9ed17\msvcp140_1.dll
- %TEMP%\cye0e9ed17\msvcp140_2.dll
- %TEMP%\cye0e9ed17\msvcp140_atomic_wait.dll
- %TEMP%\cye0e9ed17\msvcp140_codecvt_ids.dll
- %TEMP%\cye0e9ed17\concrt140.dll
- %APPDATA%\microsoft\corvus.vmp.exe
- %TEMP%\th90cd.tmp
Network activity
Connects to
- 'ap#.#papi.is':443
- 'x1.#.lencr.org':80
- 'pa###bin.com':443
- 'localhost':8080
- 'po##.#upportxmr.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ap#.#papi.is':443
- 'pa###bin.com':443
- 'po##.#upportxmr.com':443
UDP
- DNS ASK ap#.#papi.is
- DNS ASK x1.#.lencr.org
- DNS ASK pa###bin.com
- DNS ASK po##.#upportxmr.com
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Creates and executes the following
- '%TEMP%\cye0e9ed17\corvus.vmp.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' --encargs 585e011d1b121117581f0004101f4542555e0a52051c0a1e5b001002051c17060d1e175c161c084841475652580645464331131d223e0c20391432063e42262426361445363d51142c450c070042272316325d35442035104746204...
