Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AbccompanyAgent-oa1' = '"%ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe" run'
Creates or modifies the following files
- <SYSTEM32>\tasks\abccompanyagentwatchdog-oa1
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\AbccompanyAgentSvc-oa1] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\AbccompanyAgentSvc-oa1] 'ImagePath' = '%ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe service-run'
Creates the following services
- 'AbccompanyAgentSvc-oa1' %ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe service-run
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /FI "PID ne 1608" /IM abccompany-agent-oa1.exe /T
Modifies file system
Creates the following files
- %LOCALAPPDATA%\abccompanyagent-oa1\agent.log
- %ALLUSERSPROFILE%\abccompanyagent-oa1\abccompany-agent-oa1.exe
- %APPDATA%\abccompany-agent-oa1\settings.json.tmp
- %APPDATA%\abccompany-agent-oa1\credentials.json.tmp
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\abccompanyagent-oa1\abccompany-agent-oa1.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\abccompanyagent-oa1\agent.log
Moves the following files
- from %APPDATA%\abccompany-agent-oa1\settings.json.tmp to %APPDATA%\abccompany-agent-oa1\settings.json
- from %APPDATA%\abccompany-agent-oa1\credentials.json.tmp to %APPDATA%\abccompany-agent-oa1\credentials.json
Substitutes the following files
- %LOCALAPPDATA%\abccompanyagent-oa1\agent.log
Network activity
Connects to
- 'oa#####1.memberappu.com':443
- '<DNS_SERVER>':53
TCP
Other
- 'oa#####1.memberappu.com':443
UDP
- DNS ASK oa#####1.memberappu.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath '%ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe' -ArgumentList 'service-install' -Verb RunAs -Wait"
- '%ALLUSERSPROFILE%\abccompanyagent-oa1\abccompany-agent-oa1.exe' service-install
- '%ALLUSERSPROFILE%\abccompanyagent-oa1\abccompany-agent-oa1.exe' service-run
- '%ALLUSERSPROFILE%\abccompanyagent-oa1\abccompany-agent-oa1.exe' run
Executes the following
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq abccompany-agent-oa1.exe" /FO CSV /NH
- '<SYSTEM32>\sc.exe' query AbccompanyAgentSvc-oa1
- '<SYSTEM32>\schtasks.exe' /Query /TN AbccompanyAgentWatchdog-oa1
- '<SYSTEM32>\sc.exe' stop AbccompanyAgentSvc-oa1
- '<SYSTEM32>\sc.exe' delete AbccompanyAgentSvc-oa1
- '<SYSTEM32>\schtasks.exe' /Delete /F /TN AbccompanyAgentWatchdog-oa1
- '<SYSTEM32>\attrib.exe' -R -S %ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe
- '<SYSTEM32>\attrib.exe' -R -S /S /D %ALLUSERSPROFILE%\AbccompanyAgent-oa1\*
- '<SYSTEM32>\attrib.exe' -R -S /S /D %LOCALAPPDATA%\AbccompanyAgent-oa1\*
- '<SYSTEM32>\attrib.exe' -R -S /S /D %APPDATA%\abccompany-agent-oa1\*
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\AbccompanyAgent-oa1 /grant Users:(OI)(CI)M /T /Q
- '<SYSTEM32>\attrib.exe' +R +S %ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe
- '<SYSTEM32>\schtasks.exe' /Create /F /TN AbccompanyAgentWatchdog-oa1 /SC MINUTE /MO 1 /TR "\"%ALLUSERSPROFILE%\AbccompanyAgent-oa1\abccompany-agent-oa1.exe\" run"
