Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Gevrkolbes' = '%TEMP%\Requested\Guardianess.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'Rmc-DJMVMO' = '"%ALLUSERSPROFILE%\Remcos\remcos.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run\] 'Rmc-DJMVMO' = '"%ALLUSERSPROFILE%\Remcos\remcos.exe"'
Malicious functions
Injects code into
the following user processes:
- remcos.exe
Patches code
in dll
- rslylc.exe process, KERNEL32.dll module
- rslylc.exe process, KERNELBASE.dll module
- rslylc.exe process, RPCRT4.dll module
- rslylc.exe process, ole32.dll module
- rslylc.exe process, combase.dll module
- rslylc.exe process, bcryptPrimitives.dll module
- rslylc.exe process, CLBCatQ.DLL module
- rslylc.exe process, bcrypt.dll module
- rslylc.exe process, SCHANNEL.dll module
- rslylc.exe process, mskeyprotect.dll module
- rslylc.exe process, NTASN1.dll module
- rslylc.exe process, CRYPT32.dll module
- rslylc.exe process, RSAENH.dll module
- rslylc.exe process, ncrypt.dll module
- rslylc.exe process, ncryptsslp.dll module
- remcos.exe process, KERNEL32.dll module
in NTDLL dll
- rslylc.exe process, ntdll.dll module
- remcos.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %HOMEPATH%\barbaras250\eksperimentalteaterets\tropismatic
- %HOMEPATH%\barbaras250\eksperimentalteaterets\autodafqsen.daa
- %HOMEPATH%\barbaras250\eksperimentalteaterets\miljbeskyttelseshensynene
- %HOMEPATH%\barbaras250\eksperimentalteaterets\arbejdsgiverorganisationen.ser
- %HOMEPATH%\barbaras250\eksperimentalteaterets\coccin.hal
- %HOMEPATH%\barbaras250\eksperimentalteaterets\gem.for
- %HOMEPATH%\barbaras250\eksperimentalteaterets\johannes.tai
- %HOMEPATH%\barbaras250\eksperimentalteaterets\salvage.kry
- %TEMP%\callisto.ini
- %HOMEPATH%\afbillede.ini
- %TEMP%\nso6b0b.tmp\system.dll
- %TEMP%\requested\guardianess.exe
- %ALLUSERSPROFILE%\remcos\remcos.exe
- %TEMP%\nsg1729.tmp\system.dll
Network activity
Connects to
- 'be###lle.biz':443
- 'oc##.##lsecuretrust.com':80
- 'cr##.ssl.com':80
- 'oc###.ssl.com':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a3##############
- http://cr##.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- http://oc###.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSw%2FJflvJoS3MArxLrr2Jd3vmTF9gQUebqUd6ANGd005jmk%2FEyl0lpt9YwCEFmoKGQ1Oo1mbm0RyTs48UA%3D
HTTP POST requests
- http://oc##.##lsecuretrust.com/
Other
- 'be###lle.biz':443
UDP
- DNS ASK be###lle.biz
- DNS ASK oc##.##lsecuretrust.com
- DNS ASK cr##.ssl.com
- DNS ASK oc###.ssl.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\remcos\remcos.exe'
Restarts the analyzed sample
