Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%APPDATA%\OneDriveStarter.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveStarter' = '%LOCALAPPDATA%\RuntimeBrokerSrv.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'GoogleUpdateCore' = '%ALLUSERSPROFILE%\csrsss.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '<Full path to file>'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdatetask
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.exe
Malicious functions
Patches code
in AMSI dll
- xlthsuy.exe process, Amsi.dll module
in NTDLL dll
- xlthsuy.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %APPDATA%\onedrivestarter.exe
- %LOCALAPPDATA%\runtimebrokersrv.exe
- %ALLUSERSPROFILE%\csrsss.exe
- %HOMEPATH%\winupd.exe
- %APPDATA%\microsoft\windows\start menu\svchost.exe
- %WINDIR%\googleupdatecore.exe
- %TEMP%\googleupdatecore.exe
- %APPDATA%\microsoft\svchost.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\onedrivestarter.exe
- %LOCALAPPDATA%\runtimebrokersrv.exe
- %ALLUSERSPROFILE%\csrsss.exe
- %HOMEPATH%\winupd.exe
- %APPDATA%\microsoft\windows\start menu\svchost.exe
- %WINDIR%\googleupdatecore.exe
- %TEMP%\googleupdatecore.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.exe
- %APPDATA%\microsoft\svchost.exe
Network activity
Connects to
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\onedrivestarter.exe'
- '%LOCALAPPDATA%\runtimebrokersrv.exe'
- '%ALLUSERSPROFILE%\csrsss.exe'
- '%HOMEPATH%\winupd.exe'
- '%APPDATA%\microsoft\windows\start menu\svchost.exe'
- '%WINDIR%\googleupdatecore.exe'
- '%TEMP%\googleupdatecore.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wevtutil cl System && wevtutil cl Security && wevtutil cl Application
- '<SYSTEM32>\wevtutil.exe' cl System
- '<SYSTEM32>\wevtutil.exe' cl Security
- '<SYSTEM32>\wevtutil.exe' cl Application
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsUpdateTask" /tr "<Full path to file>" /sc onlogon /f
- '%APPDATA%\onedrivestarter.exe' ' (with hidden window)
- '%LOCALAPPDATA%\runtimebrokersrv.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\csrsss.exe' ' (with hidden window)
- '%HOMEPATH%\winupd.exe' ' (with hidden window)
- '%APPDATA%\microsoft\windows\start menu\svchost.exe' ' (with hidden window)
- '%WINDIR%\googleupdatecore.exe' ' (with hidden window)
- '%TEMP%\googleupdatecore.exe' ' (with hidden window)
