Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'ImagePath' = '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\sejwafmrhmsx.sys'
Creates the following services
- 'NUXCTTKD' %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\sejwafmrhmsx.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\applicationframehost.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\wusa.exe
the following user processes:
- iexplore.exe
- firefox.exe
- input.exe
- cryptor.dll
- 1.exe
- sletikpcfccn.exe
Hooks functions
in browsers
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
Patches code
in dll
- dialer.exe process, KERNEL32.dll module
- runtimebroker.exe process, ADVAPI32.dll module
- input.exe process, SECHOST.dll module
- input.exe process, ADVAPI32.dll module
- zqlrtrv.exe process, SECHOST.dll module
- zqlrtrv.exe process, ADVAPI32.dll module
- cryptor.dll process, SECHOST.dll module
- cryptor.dll process, ADVAPI32.dll module
- svchost.exe process, SECHOST.dll module
- svchost.exe process, ADVAPI32.dll module
- powercfg.exe process, SECHOST.dll module
- powercfg.exe process, ADVAPI32.dll module
- sc.exe process, SECHOST.dll module
- sc.exe process, ADVAPI32.dll module
- powershell.exe process, SECHOST.dll module
- powershell.exe process, ADVAPI32.dll module
- cmd.exe process, SECHOST.dll module
- cmd.exe process, ADVAPI32.dll module
- wusa.exe process, SECHOST.dll module
- wusa.exe process, ADVAPI32.dll module
in AMSI dll
- input.exe process, Amsi.dll module
in NTDLL dll
- input.exe process, ntdll.dll module
- dialer.exe process, ntdll.dll module
- zqlrtrv.exe process, ntdll.dll module
- cryptor.dll process, ntdll.dll module
- svchost.exe process, ntdll.dll module
- powercfg.exe process, ntdll.dll module
- sc.exe process, ntdll.dll module
- powershell.exe process, ntdll.dll module
- cmd.exe process, ntdll.dll module
- wusa.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\dialer.exe
Modifies file system
Creates the following files
- %TEMP%\_mei00000c642\vcruntime140.dll
- %TEMP%\_mei00000c642\_bz2.pyd
- %TEMP%\_mei00000c642\_ctypes.pyd
- %TEMP%\_mei00000c642\_decimal.pyd
- %TEMP%\_mei00000c642\_hashlib.pyd
- %TEMP%\_mei00000c642\_lzma.pyd
- %TEMP%\_mei00000c642\_socket.pyd
- %TEMP%\_mei00000c642\_ssl.pyd
- %TEMP%\_mei00000c642\_zstd.pyd
- %TEMP%\_mei00000c642\base_library.zip
- %TEMP%\_mei00000c642\libcrypto-3.dll
- %TEMP%\_mei00000c642\libffi-8.dll
- %TEMP%\_mei00000c642\libssl-3.dll
- %TEMP%\_mei00000c642\python314.dll
- %TEMP%\_mei00000c642\select.pyd
- %TEMP%\_mei00000c642\unicodedata.pyd
- %TEMP%\ahe2gjoh
- %TEMP%\neet_marker.txt
- %TEMP%\tmpuockxzwl\input.exe
- %TEMP%\tmplh2g7wfr\cryptor.dll
- %TEMP%\_mei45482\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei45482\vcruntime140.dll
- %TEMP%\_mei45482\vcruntime140_1.dll
- %TEMP%\_mei45482\_asyncio.pyd
- %TEMP%\_mei45482\_bz2.pyd
- %TEMP%\_mei45482\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei45482\_ctypes.pyd
- %TEMP%\_mei45482\_decimal.pyd
- %TEMP%\_mei45482\_hashlib.pyd
- %TEMP%\_mei45482\_lzma.pyd
- %TEMP%\_mei45482\_multiprocessing.pyd
- %TEMP%\_mei45482\_overlapped.pyd
- %TEMP%\_mei45482\_queue.pyd
- %TEMP%\_mei45482\_socket.pyd
- %TEMP%\_mei45482\_sqlite3.pyd
- %TEMP%\_mei45482\_ssl.pyd
- %TEMP%\_mei45482\_wmi.pyd
- %TEMP%\_mei45482\base_library.zip
- %TEMP%\_mei45482\certifi\cacert.pem
- %TEMP%\_mei45482\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei45482\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei45482\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei45482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei45482\libcrypto-3.dll
- %TEMP%\_mei45482\libffi-8.dll
- %TEMP%\_mei45482\libssl-3.dll
- %TEMP%\_mei45482\psutil\_psutil_windows.pyd
- %TEMP%\_mei45482\pyexpat.pyd
- %TEMP%\_mei45482\python3.dll
- %TEMP%\_mei45482\python313.dll
- %TEMP%\_mei45482\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei45482\select.pyd
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei45482\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei45482\sqlite3.dll
- %TEMP%\_mei45482\unicodedata.pyd
- %TEMP%\_mei45482\win32\win32api.pyd
- %TEMP%\_mei45482\win32\win32clipboard.pyd
- %TEMP%\_mei45482\win32\win32crypt.pyd
- %TEMP%\_mei45482\win32\win32security.pyd
- %TEMP%\eitnpwt9
- %TEMP%\tmp794oho_1\1.exe
- %TEMP%\tmpja8jo_df\stealer.exe
- %TEMP%\_mei35482\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pythonwin\mfc140u.dll
- %TEMP%\_mei35482\pythonwin\win32ui.pyd
- %TEMP%\_mei35482\vcruntime140.dll
- %TEMP%\_mei35482\vcruntime140_1.dll
- %TEMP%\_mei35482\_asyncio.pyd
- %TEMP%\_mei35482\_bz2.pyd
- %TEMP%\_mei35482\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei35482\_ctypes.pyd
- %TEMP%\_mei35482\_decimal.pyd
- %TEMP%\_mei35482\_elementtree.pyd
- %TEMP%\_mei35482\_hashlib.pyd
- %TEMP%\_mei35482\_lzma.pyd
- %TEMP%\_mei35482\_multiprocessing.pyd
- %TEMP%\_mei35482\_overlapped.pyd
- %TEMP%\_mei35482\_queue.pyd
- %TEMP%\_mei35482\_socket.pyd
- %TEMP%\_mei35482\_sqlite3.pyd
- %TEMP%\_mei35482\_ssl.pyd
- %TEMP%\_mei35482\_wmi.pyd
- %TEMP%\_mei35482\base_library.zip
- %TEMP%\_mei35482\certifi\cacert.pem
- %TEMP%\_mei35482\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei35482\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei35482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei35482\libcrypto-3.dll
- %TEMP%\_mei35482\libffi-8.dll
- %TEMP%\_mei35482\libssl-3.dll
- %TEMP%\_mei35482\psutil\_psutil_windows.pyd
- %TEMP%\_mei35482\pyexpat.pyd
- %TEMP%\_mei35482\python3.dll
- %TEMP%\_mei35482\python313.dll
- %TEMP%\_mei35482\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei35482\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei35482\select.pyd
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei35482\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei35482\sqlite3.dll
- %TEMP%\_mei35482\unicodedata.pyd
- %TEMP%\_mei35482\win32\_win32sysloader.pyd
- %TEMP%\_mei35482\win32\win32api.pyd
- %TEMP%\_mei35482\win32\win32clipboard.pyd
- %TEMP%\_mei35482\win32\win32crypt.pyd
- %TEMP%\_mei35482\win32\win32event.pyd
- %TEMP%\_mei35482\win32\win32security.pyd
- %TEMP%\_mei35482\win32\win32trace.pyd
- %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- %WINDIR%\temp\__psscriptpolicytest_2shldtft.vpo.ps1
- %WINDIR%\temp\__psscriptpolicytest_0x1c2w4w.n40.psm1
- %WINDIR%\temp\__psscriptpolicytest_vgyuqbmn.byr.ps1
- %WINDIR%\temp\__psscriptpolicytest_cqyiapfn.ubl.psm1
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\sejwafmrhmsx.sys
Deletes following files that it created itself
- %TEMP%\ahe2gjoh
- %TEMP%\eitnpwt9
- %TEMP%\_mei35482\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei35482\base_library.zip
- %TEMP%\_mei35482\certifi\cacert.pem
- %TEMP%\_mei35482\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei35482\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei35482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei35482\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei35482\libcrypto-3.dll
- %TEMP%\_mei35482\libffi-8.dll
- %TEMP%\_mei35482\libssl-3.dll
- %TEMP%\_mei35482\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei35482\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei35482\psutil\_psutil_windows.pyd
- %TEMP%\_mei35482\pyexpat.pyd
- %TEMP%\_mei35482\python3.dll
- %TEMP%\_mei35482\python313.dll
- %TEMP%\_mei35482\pythonwin\mfc140u.dll
- %TEMP%\_mei35482\pythonwin\win32ui.pyd
- %TEMP%\_mei35482\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei35482\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei35482\select.pyd
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei35482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei35482\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei35482\sqlite3.dll
- %TEMP%\_mei35482\unicodedata.pyd
- %TEMP%\_mei35482\vcruntime140.dll
- %TEMP%\_mei35482\vcruntime140_1.dll
- %TEMP%\_mei35482\win32\win32api.pyd
- %TEMP%\_mei35482\win32\win32clipboard.pyd
- %TEMP%\_mei35482\win32\win32crypt.pyd
- %TEMP%\_mei35482\win32\win32event.pyd
- %TEMP%\_mei35482\win32\win32security.pyd
- %TEMP%\_mei35482\win32\win32trace.pyd
- %TEMP%\_mei35482\win32\_win32sysloader.pyd
- %TEMP%\_mei35482\_asyncio.pyd
- %TEMP%\_mei35482\_bz2.pyd
- %TEMP%\_mei35482\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei35482\_ctypes.pyd
- %TEMP%\_mei35482\_decimal.pyd
- %TEMP%\_mei35482\_elementtree.pyd
- %TEMP%\_mei35482\_hashlib.pyd
- %TEMP%\_mei35482\_lzma.pyd
- %TEMP%\_mei35482\_multiprocessing.pyd
- %TEMP%\_mei35482\_overlapped.pyd
- %TEMP%\_mei35482\_queue.pyd
- %TEMP%\_mei35482\_socket.pyd
- %TEMP%\_mei35482\_sqlite3.pyd
- %TEMP%\_mei35482\_ssl.pyd
- %TEMP%\_mei35482\_wmi.pyd
- %WINDIR%\temp\__psscriptpolicytest_2shldtft.vpo.ps1
- %WINDIR%\temp\__psscriptpolicytest_0x1c2w4w.n40.psm1
- %WINDIR%\temp\__psscriptpolicytest_vgyuqbmn.byr.ps1
- %WINDIR%\temp\__psscriptpolicytest_cqyiapfn.ubl.psm1
Modifies the following files
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
Network activity
Connects to
- 'he##.#cptunnel.su':1591
- 'po##.#ashvault.pro':443
TCP
Other
- 'po##.#ashvault.pro':443
UDP
- DNS ASK he##.#cptunnel.su
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '%TEMP%\tmpuockxzwl\input.exe'
- '%TEMP%\tmplh2g7wfr\cryptor.dll'
- '%TEMP%\tmp794oho_1\1.exe'
- '%TEMP%\tmpja8jo_df\stealer.exe'
- '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\calc.exe'
- '%ProgramFiles%\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\calculator.exe' -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "NUXCTTKD"
- '<SYSTEM32>\sc.exe' create "NUXCTTKD" binpath= "%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "NUXCTTKD"
- '%TEMP%\tmpuockxzwl\input.exe' ' (with hidden window)
- '%TEMP%\tmplh2g7wfr\cryptor.dll' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\calc.exe' ' (with hidden window)
- '%TEMP%\tmp794oho_1\1.exe' ' (with hidden window)
- '%TEMP%\tmpja8jo_df\stealer.exe' ' (with hidden window)
