Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\startup_injected.bat
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei46842\vcruntime140.dll
- %TEMP%\_mei46842\_bz2.pyd
- %TEMP%\_mei46842\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei46842\_ctypes.pyd
- %TEMP%\_mei46842\_decimal.pyd
- %TEMP%\_mei46842\_hashlib.pyd
- %TEMP%\_mei46842\_lzma.pyd
- %TEMP%\_mei46842\_multiprocessing.pyd
- %TEMP%\_mei46842\_queue.pyd
- %TEMP%\_mei46842\_socket.pyd
- %TEMP%\_mei46842\_ssl.pyd
- %TEMP%\_mei46842\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei46842\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei46842\base_library.zip
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\installer
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\metadata
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\record
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\wheel
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei46842\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei46842\libcrypto-1_1.dll
- %TEMP%\_mei46842\libffi-8.dll
- %TEMP%\_mei46842\libssl-1_1.dll
- %TEMP%\_mei46842\pyexpat.pyd
- %TEMP%\_mei46842\python3.dll
- %TEMP%\_mei46842\python311.dll
- %TEMP%\_mei46842\select.pyd
- %TEMP%\_mei46842\ucrtbase.dll
- %TEMP%\_mei46842\unicodedata.pyd
- %TEMP%\vhefpi1h
- %TEMP%\tmpij68hhye.exe
- %TEMP%\payload_launcher.bat
- %TEMP%\dotff.exe
- %TEMP%\_mei14602\vcruntime140.dll
- %TEMP%\_mei14602\_bz2.pyd
- %TEMP%\_mei14602\_decimal.pyd
- %TEMP%\_mei14602\_hashlib.pyd
- %TEMP%\_mei14602\_lzma.pyd
- %TEMP%\_mei14602\_socket.pyd
- %TEMP%\_mei14602\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei14602\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei14602\base_library.zip
- %TEMP%\_mei14602\libcrypto-1_1.dll
- %TEMP%\_mei14602\python311.dll
- %TEMP%\_mei14602\select.pyd
- %TEMP%\_mei14602\ucrtbase.dll
- %TEMP%\_mei14602\unicodedata.pyd
- %APPDATA%\startupinjected\mogvk.exe
- %APPDATA%\startupinjected\installed.flag
- %TEMP%\tmpcfde.tmp
- %TEMP%\tmpd147.tmp
- %APPDATA%\microsoft\crypto\keys\f4e17f69b8480bf30f3bbb25ad4b6147_8cf7b530-613e-439b-a8c5-ccfc0e745400
Удаляет файлы, которые сам же создал
- %TEMP%\vhefpi1h
- %TEMP%\_mei46842\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei46842\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei46842\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei46842\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei46842\base_library.zip
- %TEMP%\_mei46842\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\installer
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\metadata
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\record
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei46842\cryptography-50.0.0.dist-info\wheel
- %TEMP%\_mei46842\libcrypto-1_1.dll
- %TEMP%\_mei46842\libffi-8.dll
- %TEMP%\_mei46842\libssl-1_1.dll
- %TEMP%\_mei46842\pyexpat.pyd
- %TEMP%\_mei46842\python3.dll
- %TEMP%\_mei46842\python311.dll
- %TEMP%\_mei46842\select.pyd
- %TEMP%\_mei46842\ucrtbase.dll
- %TEMP%\_mei46842\unicodedata.pyd
- %TEMP%\_mei46842\vcruntime140.dll
- %TEMP%\_mei46842\_bz2.pyd
- %TEMP%\_mei46842\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei46842\_ctypes.pyd
- %TEMP%\_mei46842\_decimal.pyd
- %TEMP%\_mei46842\_hashlib.pyd
- %TEMP%\_mei46842\_lzma.pyd
- %TEMP%\_mei46842\_multiprocessing.pyd
- %TEMP%\_mei46842\_queue.pyd
- %TEMP%\_mei46842\_socket.pyd
- %TEMP%\_mei46842\_ssl.pyd
- %TEMP%\_mei14602\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei14602\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei14602\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei14602\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei14602\base_library.zip
- %TEMP%\_mei14602\libcrypto-1_1.dll
- %TEMP%\_mei14602\python311.dll
- %TEMP%\_mei14602\select.pyd
- %TEMP%\_mei14602\ucrtbase.dll
- %TEMP%\_mei14602\unicodedata.pyd
- %TEMP%\_mei14602\vcruntime140.dll
- %TEMP%\_mei14602\_bz2.pyd
- %TEMP%\_mei14602\_decimal.pyd
- %TEMP%\_mei14602\_hashlib.pyd
- %TEMP%\_mei14602\_lzma.pyd
- %TEMP%\_mei14602\_socket.pyd
- %TEMP%\tmpcfde.tmp
- %TEMP%\tmpd147.tmp
Сетевая активность
Подключается к
- '14#.#6.103.23':8080
TCP
Другие
- '14#.#6.103.23':8080
Другое
Создает и запускает на исполнение
- '%TEMP%\tmpij68hhye.exe'
- '%TEMP%\dotff.exe'
- '%APPDATA%\startupinjected\mogvk.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHcAcwBuACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAZQBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA... (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\payload_launcher.bat" " (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Start-Process '"C:/Users/Ryan/Desktop/XWormClient.exe"'"
- '%TEMP%\dotff.exe' (со скрытым окном)
