Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\runtimebroker.exe
the following user processes:
- chrome.exe
- msedge.exe
Patches code
in NTDLL dll
- iksqtlir.exe process, ntdll.dll module
- runtimebroker.exe process, ntdll.dll module
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\nativeloader_1180.log
- %TEMP%\nativeloader_2664.log
- %TEMP%\tmp330d.tmp.dat
- %TEMP%\tmp33aa.tmp.dat
- %TEMP%\tmp33ca.tmp.dat
- %TEMP%\tmp33eb.tmp.dat
- %TEMP%\tmp33fb.tmp.dat
- %TEMP%\tmp340c.tmp.dat
- %TEMP%\tmp341d.tmp.dat
- %TEMP%\tmp343d.tmp.dat
- %TEMP%\tmp349c.tmp.dat
- %TEMP%\tmp34ac.tmp.dat
- %TEMP%\tmp3559.tmp.dat
- %TEMP%\tmp35e7.tmp.dat
- %TEMP%\tmp3645.tmp.dat
- %TEMP%\tmp3666.tmp.dat
- %TEMP%\tmp36c4.tmp.dat
- %TEMP%\tmp3723.tmp.dat
- %TEMP%\tmp3763.tmp.dat
- %TEMP%\tmp3783.tmp.dat
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\current
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\log
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\manifest-000001
- %TEMP%\tmp483d.tmp.dat
- %TEMP%\tmp484e.tmp.dat
- %TEMP%\tmp484f.tmp.dat
- %TEMP%\tmp485f.tmp.dat
- %TEMP%\tmp4870.tmp.dat
- %TEMP%\tmp4871.tmp.dat
- %TEMP%\tmp4882.tmp.dat
- %TEMP%\tmp4892.tmp.dat
- %TEMP%\d6eca09e-92e8-46ca-9528-5886ffac41de\logs.txt
Deletes following files that it created itself
- %TEMP%\tmp330d.tmp.dat
- %TEMP%\tmp33aa.tmp.dat
- %TEMP%\tmp33ca.tmp.dat
- %TEMP%\tmp33eb.tmp.dat
- %TEMP%\tmp33fb.tmp.dat
- %TEMP%\tmp340c.tmp.dat
- %TEMP%\tmp341d.tmp.dat
- %TEMP%\tmp343d.tmp.dat
- %TEMP%\tmp349c.tmp.dat
- %TEMP%\tmp34ac.tmp.dat
- %TEMP%\tmp3559.tmp.dat
- %TEMP%\tmp35e7.tmp.dat
- %TEMP%\tmp3645.tmp.dat
- %TEMP%\tmp3666.tmp.dat
- %TEMP%\tmp36c4.tmp.dat
- %TEMP%\tmp3723.tmp.dat
- %TEMP%\tmp3763.tmp.dat
- %TEMP%\tmp3783.tmp.dat
- %TEMP%\tmp483d.tmp.dat
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\current
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\log
- %TEMP%\a248dc77-9e60-4299-b206-089f2e431e3a\manifest-000001
- %TEMP%\tmp484e.tmp.dat
- %TEMP%\tmp484f.tmp.dat
- %TEMP%\tmp485f.tmp.dat
- %TEMP%\tmp4870.tmp.dat
- %TEMP%\tmp4871.tmp.dat
- %TEMP%\tmp4882.tmp.dat
- %TEMP%\tmp4892.tmp.dat
- %TEMP%\d6eca09e-92e8-46ca-9528-5886ffac41de\logs.txt
Network activity
Connects to
- '14#.#3.137.221':8080
- '14#.#3.137.221':8443
- '19#.#32.210.172':80
- 'ms###csi.com':443
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://14#.##.137.221:8080/3082218e-bf46-4040-987d-869fa30a356c via 14#.#3.137.221
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca##############
- http://ip##pi.com/line/?fi##################
Other
- '14#.#3.137.221':8443
- 'ms###csi.com':443
UDP
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TeamViewer'
Executes the following
- '<SYSTEM32>\runtimebroker.exe'
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' ' (with hidden window)
