Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Environment] 'UserInitMprLogonScript' = '"%ALLUSERSPROFILE%\MaroonTulip\RippleOctagon.exe" @'
Malicious functions
Patches code
in AMSI dll
- rippleoctagon.exe process, Amsi.dll module
- vibrantzenith.exe process, Amsi.dll module
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %LOCALAPPDATA%\storexa3p2\profile.ini
- %LOCALAPPDATA%\storexa3p2\update.log
- %LOCALAPPDATA%\storexa3p2\newupdates1.zip
- %LOCALAPPDATA%\storexa3p2\newupdates1.exe
- %LOCALAPPDATA%\storexa3p2\newupdates2.zip
- %LOCALAPPDATA%\storexa3p2\newupdates2.exe
- %LOCALAPPDATA%\storexa3p2\newupdates3.zip
- %LOCALAPPDATA%\storexa3p2\newupdates3.exe
- %TEMP%\is-s6gmhcq3lb.tmp\newupdates2.tmp
- %TEMP%\is-9bl8q0b117.tmp\newupdates3.tmp
- %TEMP%\is-bf201e9jjh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3dphiiik5w.tmp\_isetup\_setup64.tmp
- %ALLUSERSPROFILE%\maroontulip\is-7enx4axhjn.tmp
- %TEMP%\maroonmosaic\is-hbibbyxjxr.tmp
- %TEMP%\maroonmosaic\is-zdj4tlrmaj.tmp
- %ALLUSERSPROFILE%\maroontulip\is-m5zzqr5v6m.tmp
- %ALLUSERSPROFILE%\maroontulip\harboravenue\is-rlz4dk4igt.tmp
- %TEMP%\maroonmosaic\cadenceneedle\is-8xjlzw3u9u.tmp
- %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-nfgbeoa5d3.tmp
- %TEMP%\maroonmosaic\appleeasel\is-zxrraqxn1k.tmp
- %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-xhehk46lym.tmp
- %TEMP%\maroonmosaic\velvetgarden\is-sa1w19yhly.tmp
- %ALLUSERSPROFILE%\maroontulip\harboravenue\is-mzfxqraiha.tmp
- %TEMP%\maroonmosaic\cadenceneedle\is-o8nf8tk730.tmp
- %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-4g481g3cws.tmp
- %TEMP%\maroonmosaic\appleeasel\is-188c1tm0t7.tmp
- %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-ojhqymq9ai.tmp
- %TEMP%\maroonmosaic\velvetgarden\is-zz2xd2lyvy.tmp
- %ALLUSERSPROFILE%\maroontulip\harboravenue\is-s1fq9hptei.tmp
- %TEMP%\maroonmosaic\cadenceneedle\is-92p3kueent.tmp
- %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-55nxn9scyc.tmp
- %TEMP%\maroonmosaic\appleeasel\is-6zvhrm9tm0.tmp
- %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-12or56hfsq.tmp
- %ALLUSERSPROFILE%\maroontulip\harboravenue\is-drp7111qra.tmp
- %TEMP%\maroonmosaic\velvetgarden\is-p67v4oz9vt.tmp
- %ALLUSERSPROFILE%\maroontulip\args.dat
- %APPDATA%\prefslogs\09-22-2026
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\vibrantzenith.exe.log
Deletes following files that it created itself
- %TEMP%\is-bf201e9jjh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3dphiiik5w.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s6gmhcq3lb.tmp\newupdates2.tmp
- %TEMP%\is-9bl8q0b117.tmp\newupdates3.tmp
Moves the following files
- from %TEMP%\maroonmosaic\is-hbibbyxjxr.tmp to %TEMP%\maroonmosaic\foggy-bronze.exe
- from %ALLUSERSPROFILE%\maroontulip\is-7enx4axhjn.tmp to %ALLUSERSPROFILE%\maroontulip\cyclone-mistral.exe
- from %TEMP%\maroonmosaic\is-zdj4tlrmaj.tmp to %TEMP%\maroonmosaic\vibrantzenith.exe
- from %ALLUSERSPROFILE%\maroontulip\is-m5zzqr5v6m.tmp to %ALLUSERSPROFILE%\maroontulip\rippleoctagon.exe
- from %ALLUSERSPROFILE%\maroontulip\harboravenue\is-rlz4dk4igt.tmp to %ALLUSERSPROFILE%\maroontulip\harboravenue\wandererchorus.wav
- from %TEMP%\maroonmosaic\cadenceneedle\is-8xjlzw3u9u.tmp to %TEMP%\maroonmosaic\cadenceneedle\jasperavenue.wav
- from %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-nfgbeoa5d3.tmp to %ALLUSERSPROFILE%\maroontulip\robinpioneer\berrytorrent.wav
- from %TEMP%\maroonmosaic\appleeasel\is-zxrraqxn1k.tmp to %TEMP%\maroonmosaic\appleeasel\waveletllama.wav
- from %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-xhehk46lym.tmp to %ALLUSERSPROFILE%\maroontulip\lemursmooth\needlehorizon.wav
- from %TEMP%\maroonmosaic\velvetgarden\is-sa1w19yhly.tmp to %TEMP%\maroonmosaic\velvetgarden\needlemorning.wav
- from %ALLUSERSPROFILE%\maroontulip\harboravenue\is-mzfxqraiha.tmp to %ALLUSERSPROFILE%\maroontulip\harboravenue\solsticecreek.wav
- from %TEMP%\maroonmosaic\cadenceneedle\is-o8nf8tk730.tmp to %TEMP%\maroonmosaic\cadenceneedle\preludeplatinum.wav
- from %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-4g481g3cws.tmp to %ALLUSERSPROFILE%\maroontulip\robinpioneer\modestclear.wav
- from %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-ojhqymq9ai.tmp to %ALLUSERSPROFILE%\maroontulip\lemursmooth\ledgercocoa.wav
- from %TEMP%\maroonmosaic\appleeasel\is-188c1tm0t7.tmp to %TEMP%\maroonmosaic\appleeasel\octagonbirch.wav
- from %TEMP%\maroonmosaic\velvetgarden\is-zz2xd2lyvy.tmp to %TEMP%\maroonmosaic\velvetgarden\daybreakcyclone.wav
- from %ALLUSERSPROFILE%\maroontulip\harboravenue\is-s1fq9hptei.tmp to %ALLUSERSPROFILE%\maroontulip\harboravenue\poppytopaz.wav
- from %TEMP%\maroonmosaic\cadenceneedle\is-92p3kueent.tmp to %TEMP%\maroonmosaic\cadenceneedle\quietheron.wav
- from %ALLUSERSPROFILE%\maroontulip\robinpioneer\is-55nxn9scyc.tmp to %ALLUSERSPROFILE%\maroontulip\robinpioneer\creekoverture.wav
- from %ALLUSERSPROFILE%\maroontulip\lemursmooth\is-12or56hfsq.tmp to %ALLUSERSPROFILE%\maroontulip\lemursmooth\goldenwharf.wav
- from %ALLUSERSPROFILE%\maroontulip\harboravenue\is-drp7111qra.tmp to %ALLUSERSPROFILE%\maroontulip\harboravenue\plainvista.wav
- from %TEMP%\maroonmosaic\appleeasel\is-6zvhrm9tm0.tmp to %TEMP%\maroonmosaic\appleeasel\sprayberyl.wav
- from %TEMP%\maroonmosaic\velvetgarden\is-p67v4oz9vt.tmp to %TEMP%\maroonmosaic\velvetgarden\deltatundra.wav
Network activity
Connects to
- '17#.#6.75.202':80
- 'localhost':49694
- 'ur#.##overpool.com':443
- '12#.#5.231.32':80
- 'localhost':49699
- 'do#####d.cloverpool.com':443
- '69.##.228.77':8443
- 'oc##.#igicert.cn':80
- 'ip##pi.com':80
- '64.#2.80.46':1488
TCP
HTTP GET requests
- http://17#.#6.75.202/storage-2/newupdates3.zip
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?03##############
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBRr4%2BiIrsX9hkefvihPQKu88%2B%2FgQUxauLpwY1%2Fdd9vOT582SojD%2FYwDkCEARa9oYvBUfxYq4ONtegKeg%3D
- http://ip##pi.com/json/
Other
- 'localhost':49694
- 'localhost':49695
- 'ur#.##overpool.com':443
- 'localhost':49699
- 'localhost':49700
- 'do#####d.cloverpool.com':443
- '69.##.228.77':8443
- '64.#2.80.46':1488
UDP
- DNS ASK ur#.##overpool.com
- DNS ASK do#####d.cloverpool.com
- DNS ASK oc##.#igicert.cn
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\storexa3p2\newupdates1.exe'
- '%LOCALAPPDATA%\storexa3p2\newupdates2.exe'
- '%LOCALAPPDATA%\storexa3p2\newupdates3.exe'
- '%TEMP%\is-9bl8q0b117.tmp\newupdates3.tmp' /SL5="$C01D0,4111304,893952,%LOCALAPPDATA%\StorexA3P2\newupdates3.exe"
- '%TEMP%\is-s6gmhcq3lb.tmp\newupdates2.tmp' /SL5="$801BC,2656042,893952,%LOCALAPPDATA%\StorexA3P2\newupdates2.exe"
- '%ALLUSERSPROFILE%\maroontulip\cyclone-mistral.exe' "%ALLUSERSPROFILE%\MaroonTulip\RippleOctagon.exe" "%ALLUSERSPROFILE%\MaroonTulip\HarborAvenue\WandererChorus.wav" "%ALLUSERSPROFILE%\MaroonTulip\RobinPioneer\BerryTorrent.wav" "%ALLUSERSPROFILE...
- '%TEMP%\maroonmosaic\foggy-bronze.exe' "%TEMP%\MaroonMosaic\VibrantZenith.exe" "%TEMP%\MaroonMosaic\CadenceNeedle\JasperAvenue.wav" "%TEMP%\MaroonMosaic\AppleEasel\WaveletLlama.wav" "%TEMP%\MaroonMosaic\VelvetGarden\NeedleMorning.wa...
- '%ALLUSERSPROFILE%\maroontulip\rippleoctagon.exe' "%ALLUSERSPROFILE%\MaroonTulip\HarborAvenue\WandererChorus.wav" "%ALLUSERSPROFILE%\MaroonTulip\RobinPioneer\BerryTorrent.wav" "%ALLUSERSPROFILE%\MaroonTulip\LemurSmooth\NeedleHorizon.wav" "%ALL...
- '%TEMP%\maroonmosaic\vibrantzenith.exe' "%TEMP%\MaroonMosaic\CadenceNeedle\JasperAvenue.wav" "%TEMP%\MaroonMosaic\AppleEasel\WaveletLlama.wav" "%TEMP%\MaroonMosaic\VelvetGarden\NeedleMorning.wav"
