Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Malicious functions
Patches code
in NTDLL dll
- bsmarmw.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %LOCALAPPDATA%\<File name>\<File name>.exe
- %TEMP%\wctk.dat
- <Current directory>\.wctg
- <Current directory>\.wctt_ok
- <Current directory>\.wctt_paths
Network activity
Connects to
- 'c.##l4.top':443
- 'x1.#.lencr.org':80
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://ip##pi.com/json/?fi######################
Other
- 'c.##l4.top':443
UDP
- DNS ASK c.##l4.top
- DNS ASK x1.#.lencr.org
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProcessExplorer64Class' WindowName: ''
- ClassName: 'ProcessExplorerClass' WindowName: ''
