Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ZPVVEGDELTAIGP] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ZPVVEGDELTAIGP] 'ImagePath' = '%ALLUSERSPROFILE%\cnvrktbwsebashimuyg\pvqqfzuuloqy.exe'
- [HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\yirotpghcevp.sys'
Creates the following services
- 'ZPVVEGDELTAIGP' %ALLUSERSPROFILE%\cnvrktbwsebashimuyg\pvqqfzuuloqy.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\yirotpghcevp.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\cnvrktbwsebashimuyg\pvqqfzuuloqy.exe
- %WINDIR%\temp\yirotpghcevp.sys
Network activity
Connects to
- 'po##.#upportxmr.com':443
- 'pa###bin.com':443
TCP
Other
- 'po##.#upportxmr.com':443
- 'pa###bin.com':443
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\cnvrktbwsebashimuyg\pvqqfzuuloqy.exe'
Executes the following
- '<SYSTEM32>\sc.exe' delete "ZPVVEGDELTAIGP"
- '<SYSTEM32>\sc.exe' create "ZPVVEGDELTAIGP" binpath= "%ALLUSERSPROFILE%\cnvrktbwsebashimuyg\pvqqfzuuloqy.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "ZPVVEGDELTAIGP"
- '<SYSTEM32>\svchost.exe'
