Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\defendnot
- <SYSTEM32>\tasks\vegas
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Current directory>'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\royal'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'"
Injects code into
the following system processes:
- <SYSTEM32>\taskmgr.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\taskmgr.exe
Modifies file system
Creates the following files
- %TEMP%\_mei13922\vcruntime140.dll
- %TEMP%\_mei13922\vcruntime140_1.dll
- %TEMP%\_mei13922\_bz2.pyd
- %TEMP%\_mei13922\_ctypes.pyd
- %TEMP%\_mei13922\_decimal.pyd
- %TEMP%\_mei13922\_hashlib.pyd
- %TEMP%\_mei13922\_lzma.pyd
- %TEMP%\_mei13922\_socket.pyd
- %TEMP%\_mei13922\_uuid.pyd
- %TEMP%\_mei13922\_wmi.pyd
- %TEMP%\_mei13922\base_library.zip
- %TEMP%\_mei13922\data_pack\bip39.txt
- %TEMP%\_mei13922\data_pack\defendnot.dll
- %TEMP%\_mei13922\data_pack\designer.cpp
- %TEMP%\_mei13922\data_pack\royal.js
- %TEMP%\_mei13922\data_pack\royal.xml
- %TEMP%\_mei13922\data_pack\svcup.exe
- %TEMP%\_mei13922\data_pack\vegas.js
- %TEMP%\_mei13922\libcrypto-3.dll
- %TEMP%\_mei13922\libffi-8.dll
- %TEMP%\_mei13922\python313.dll
- %TEMP%\_mei13922\select.pyd
- %TEMP%\_mei13922\unicodedata.pyd
- C:\users\public\music\royal\defendnot.dll
- C:\users\public\music\royal\designer.cpp
- nul
- C:\users\public\music\royal\ctx.bin
- C:\users\public\music\royal\country.inf
- C:\users\public\music\royal\royal.js
- C:\users\public\music\royal\royal.xml
- C:\users\public\music\royal\svcup.exe
- C:\users\public\music\royal\bip39.txt
- C:\users\public\music\royal\guid
- %APPDATA%\tor\state.tmp
Deletes following files that it created itself
- %TEMP%\_mei13922\base_library.zip
- %TEMP%\_mei13922\data_pack\bip39.txt
- %TEMP%\_mei13922\data_pack\defendnot.dll
- %TEMP%\_mei13922\data_pack\designer.cpp
- %TEMP%\_mei13922\data_pack\royal.js
- %TEMP%\_mei13922\data_pack\royal.xml
- %TEMP%\_mei13922\data_pack\svcup.exe
- %TEMP%\_mei13922\data_pack\vegas.js
- %TEMP%\_mei13922\libcrypto-3.dll
- %TEMP%\_mei13922\libffi-8.dll
- %TEMP%\_mei13922\python313.dll
- %TEMP%\_mei13922\select.pyd
- %TEMP%\_mei13922\unicodedata.pyd
- %TEMP%\_mei13922\vcruntime140.dll
- %TEMP%\_mei13922\vcruntime140_1.dll
- %TEMP%\_mei13922\_bz2.pyd
- %TEMP%\_mei13922\_ctypes.pyd
- %TEMP%\_mei13922\_decimal.pyd
- %TEMP%\_mei13922\_hashlib.pyd
- %TEMP%\_mei13922\_lzma.pyd
- %TEMP%\_mei13922\_socket.pyd
- %TEMP%\_mei13922\_uuid.pyd
- %TEMP%\_mei13922\_wmi.pyd
Moves the following files
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
Network activity
Connects to
- 'ip##fo.io':443
- '80.##0.113.62':80
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'localhost':49701
- 'localhost':49703
- '13#.#43.147.91':9001
- '45.##.169.223':443
- '19#.#6.115.43':9100
- '19#.#0.151.242':443
- '17#.#5.193.9':80
- '20#.#3.164.118':443
TCP
HTTP GET requests
- http://r1#.#.lencr.org/102.crl
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
Miscellaneous
Creates and executes the following
- 'C:\users\public\music\royal\designer.cpp' --name Defender --silent
- '<SYSTEM32>\wscript.exe' C:\Users\Public\Music\royal\royal.js
- 'C:\users\public\music\royal\svcup.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '<Current directory>'""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\royal'""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-MpComputerStatus | Out-Null""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-MpComputerStatus | Out-Null"
- '<SYSTEM32>\taskmgr.exe'
- '<SYSTEM32>\curl.exe' -s --max-time 10 https://ipinfo.io/country
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn vegas /xml C:\Users\Public\Music\royal\royal.xml /f"
- '<SYSTEM32>\schtasks.exe' /create /tn vegas /xml C:\Users\Public\Music\royal\royal.xml /f
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '<Current directory>'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\royal'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-MpComputerStatus | Out-Null""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn vegas /xml C:\Users\Public\Music\royal\royal.xml /f"' (with hidden window)
- 'C:\users\public\music\royal\svcup.exe' ' (with hidden window)
