Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\servicemonitor.lnk
- <SYSTEM32>\tasks\servicemonitor-directstartup
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ServiceMonitor] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ServiceMonitor] 'ImagePath' = '"%ProgramFiles(x86)%\ServiceMonitor\ServiceMonitorService.exe"'
Creates the following services
- 'ServiceMonitor' %ProgramFiles(x86)%\ServiceMonitor\ServiceMonitorService.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "Service Monitor.exe" /f
Modifies file system
Creates the following files
- %TEMP%\installersm.msi
- %WINDIR%\temp\~df5a5c5c248907db13.tmp
- %WINDIR%\installer\sourcehash{c4c84e28-7e3d-4cbe-8b42-e324fc36f5b7}
- %WINDIR%\temp\~df5facb8106e1837c4.tmp
- %WINDIR%\temp\~df94d6a253dd533bae.tmp
- %WINDIR%\temp\~df3c5ace6b401bd51c.tmp
- %ProgramFiles(x86)%\servicemonitor\allinone.ico
- %ProgramFiles(x86)%\servicemonitor\newtonsoft.json.dll
- %ProgramFiles(x86)%\servicemonitor\servicemonitorservice.exe
- %ProgramFiles(x86)%\servicemonitor\service monitor.exe
- %ProgramFiles(x86)%\servicemonitor\log\service_monitor.log
- %WINDIR%\installer\{c4c84e28-7e3d-4cbe-8b42-e324fc36f5b7}\appicon
- %WINDIR%\temp\~dfa314effe63ee5f39.tmp
- %WINDIR%\temp\~df68ae23227635c292.tmp
- %WINDIR%\temp\~df95fd8538de0f7897.tmp
- %WINDIR%\temp\~df8857b0b97f07661d.tmp
- %WINDIR%\temp\~df2ac4a415958bccaa.tmp
- %WINDIR%\temp\~df9cf099287dd78279.tmp
- %WINDIR%\temp\~dfbb02cffc8c3f380e.tmp
- %WINDIR%\temp\~df1f0c8a06fb4a53c5.tmp
- %ProgramFiles(x86)%\servicemonitor\servicemonitor.bat
- %HOMEPATH%\desktop\servicemonitor.lnk
- %ALLUSERSPROFILE%\servicemonitorapp\last_site_id.txt
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %ALLUSERSPROFILE%\servicemonitorapp\config.txt
Deletes following files that it created itself
- %TEMP%\installersm.msi
Network activity
Connects to
- 'mi###.###taminapatraniaga.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'mi###.###taminapatraniaga.com':443
UDP
- DNS ASK mi###.###taminapatraniaga.com
- DNS ASK x1.#.lencr.org
- 'fe######11:5bb3:3a2c:340a':1434
- '<LOCALNET>..15.2':1434
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\servicemonitor\servicemonitorservice.exe'
- '%ProgramFiles(x86)%\servicemonitor\service monitor.exe'
Executes the following
- '%WINDIR%\syswow64\sc.exe' query "ServiceMonitor"
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\InstallerSM.msi" /quiet /norestart
- '%WINDIR%\syswow64\cmd.exe' /c net user Utility
- '%WINDIR%\syswow64\net.exe' user Utility
- '%WINDIR%\syswow64\net1.exe' user Utility
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "ServiceMonitor-DirectStartup" /F
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "ServiceMonitor-DirectStartup" /TR "\"%ProgramFiles(x86)%\ServiceMonitor\Service Monitor.exe\"" /SC ONCE /ST 00:00 /RU "user" /RL HIGHEST /IT /F
- '%WINDIR%\syswow64\schtasks.exe' /Run /TN "ServiceMonitor-DirectStartup"
