Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Syshost' = '"%APPDATA%\syshost.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSvc' = '%APPDATA%\runtimeurp.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security checks
- %WINDIR%\tasks\synchost.job
- <SYSTEM32>\tasks\synchost
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\explorer.exe
the following user processes:
- msedge.exe
Patches code
in AMSI dll
- keto34km.exe process, Amsi.dll module
in NTDLL dll
- keto34km.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\508softwareandos.doc
Modifies file system
Creates the following files
- %TEMP%\j2bum7xo.exe
- %TEMP%\g9pvz4w4.exe
- %TEMP%\crbn9dcf.exe
- %TEMP%\wgichg9g.exe
- %TEMP%\g6jys69z.exe
- %TEMP%\keto34km.exe
- %APPDATA%\syshost.exe
- %TEMP%\4uk5j9mn.exe
- %APPDATA%\runtimeurp.exe
- <Current directory>\skylineloader.exe
- %APPDATA%\synchost.exe
- %TEMP%\is-7lautlxbeb.tmp\j2bum7xo.tmp
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\is-mflx5zz27v.tmp\_isetup\_isdecmp.dll
- %TEMP%\ekt37reb.exe
- %TEMP%\bshik8hg.exe
- %TEMP%\m6o1h9dy.exe
- %TEMP%\is-g49bv7uw7g.tmp\m6o1h9dy.tmp
- %TEMP%\is-jsfrqt4y76.tmp\_isetup\_isdecmp.dll
- %TEMP%\kb7ki2nk.exe
- %TEMP%\3d57a3502b1046b5a30b.exe
- %TEMP%\fa2880f9870b422b9a12.exe
- %TEMP%\is-8861rkgeag.tmp\3d57a3502b1046b5a30b.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\syshost.exe
- %APPDATA%\runtimeurp.exe
- %APPDATA%\synchost.exe
- <Current directory>\skylineloader.exe
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
Modifies the following files
Network activity
Connects to
- '19#.#78.158.107':80
- 'google.com':80
- 'bing.com':80
- '19#.#51.107.186':80
TCP
HTTP GET requests
- http://www.google.com/
- http://www.bing.com/
HTTP POST requests
- http://19#.#78.158.107/auth.php
- http://19#.#51.107.186/8jdjZhdf7/index.php
- http://19#.#78.158.107/Bjsw3DlG1/index.php
- http://19#.#78.158.107/vbv/get.php?ui######################################################
- http://19#.#78.158.107/vbv/get.php?ui#######################################################
- http://19#.#78.158.107/vbv/get.php?ui##############################################################
UDP
- DNS ASK google.com
- DNS ASK bing.com
Miscellaneous
Creates and executes the following
- '%TEMP%\j2bum7xo.exe'
- '%TEMP%\g9pvz4w4.exe'
- '%TEMP%\crbn9dcf.exe'
- '%TEMP%\wgichg9g.exe'
- '%TEMP%\g6jys69z.exe'
- '%TEMP%\keto34km.exe'
- '%TEMP%\4uk5j9mn.exe'
- '%APPDATA%\syshost.exe'
- '%APPDATA%\synchost.exe'
- '<Current directory>\skylineloader.exe'
- '%TEMP%\is-7lautlxbeb.tmp\j2bum7xo.tmp' /SL5="$1402DE,3755066,888832,%TEMP%\j2bum7xo.exe"
- '%TEMP%\ekt37reb.exe'
- '%TEMP%\bshik8hg.exe'
- '%TEMP%\m6o1h9dy.exe'
- '%TEMP%\is-g49bv7uw7g.tmp\m6o1h9dy.tmp' /SL5="$6011C,3755066,888832,%TEMP%\m6o1h9dy.exe"
- '%TEMP%\kb7ki2nk.exe'
- '%TEMP%\fa2880f9870b422b9a12.exe'
- '%TEMP%\3d57a3502b1046b5a30b.exe'
- '%TEMP%\is-8861rkgeag.tmp\3d57a3502b1046b5a30b.tmp' /SL5="$901B4,3755066,888832,%TEMP%\3D57A3502B1046B5A30B.exe"
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-sandbox
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\"
- '%APPDATA%\syshost.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"' (with hidden window)
- '%TEMP%\fa2880f9870b422b9a12.exe' ' (with hidden window)
- '%TEMP%\3d57a3502b1046b5a30b.exe' ' (with hidden window)
