Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ipconfig.exe' /flushdns
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenProcess, handler: gameprocess.sys
Modifies file system :
Creates the following files:
- <Current directory>\gameprocess.sys
Deletes the following files:
- <Current directory>\gameprocess.sys
Network activity:
Connects to:
- 'wa###.eicp.net':80
UDP:
- DNS ASK wa###.eicp.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
