Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'electron.app.Grape' = '%LOCALAPPDATA%\ProUtilMegaSoftlite\Grape.exe'
Malicious functions
Injects code into
the following user processes:
- grape.exe
Modifies file system
Creates the following files
- %TEMP%\is-5t1zbetbm4.tmp\<File name>.tmp
- %TEMP%\is-szlpdg70qv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-szlpdg70qv.tmp\chrome_100_percent.pak
- %LOCALAPPDATA%\proutilmegasoftlite\chrome_100_percent.pak
- %TEMP%\is-szlpdg70qv.tmp\chrome_200_percent.pak
- %LOCALAPPDATA%\proutilmegasoftlite\chrome_200_percent.pak
- %TEMP%\is-szlpdg70qv.tmp\d3dcompiler_47.dll
- %LOCALAPPDATA%\proutilmegasoftlite\d3dcompiler_47.dll
- %TEMP%\is-szlpdg70qv.tmp\ffmpeg.dll
- %LOCALAPPDATA%\proutilmegasoftlite\ffmpeg.dll
- %TEMP%\is-szlpdg70qv.tmp\grape.exe
- %LOCALAPPDATA%\proutilmegasoftlite\grape.exe
- %TEMP%\is-szlpdg70qv.tmp\icudtl.dat
- %LOCALAPPDATA%\proutilmegasoftlite\icudtl.dat
- %TEMP%\is-szlpdg70qv.tmp\libegl.dll
- %LOCALAPPDATA%\proutilmegasoftlite\libegl.dll
- %TEMP%\is-szlpdg70qv.tmp\libglesv2.dll
- %LOCALAPPDATA%\proutilmegasoftlite\libglesv2.dll
- %TEMP%\is-szlpdg70qv.tmp\license.electron.txt
- %LOCALAPPDATA%\proutilmegasoftlite\license.electron.txt
- %TEMP%\is-szlpdg70qv.tmp\licenses.chromium.html
- %LOCALAPPDATA%\proutilmegasoftlite\licenses.chromium.html
- %TEMP%\is-szlpdg70qv.tmp\readme.txt
- %LOCALAPPDATA%\proutilmegasoftlite\readme.txt
- %TEMP%\is-szlpdg70qv.tmp\resources.pak
- %LOCALAPPDATA%\proutilmegasoftlite\resources.pak
- %TEMP%\is-szlpdg70qv.tmp\snapshot_blob.bin
- %LOCALAPPDATA%\proutilmegasoftlite\snapshot_blob.bin
- %TEMP%\is-szlpdg70qv.tmp\v8_context_snapshot.bin
- %LOCALAPPDATA%\proutilmegasoftlite\v8_context_snapshot.bin
- %TEMP%\is-szlpdg70qv.tmp\vk_swiftshader.dll
- %LOCALAPPDATA%\proutilmegasoftlite\vk_swiftshader.dll
- %TEMP%\is-szlpdg70qv.tmp\vk_swiftshader_icd.json
- %LOCALAPPDATA%\proutilmegasoftlite\vk_swiftshader_icd.json
- %TEMP%\is-szlpdg70qv.tmp\am.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\am.pak
- %TEMP%\is-szlpdg70qv.tmp\ar.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ar.pak
- %TEMP%\is-szlpdg70qv.tmp\bg.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\bg.pak
- %TEMP%\is-szlpdg70qv.tmp\bn.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\bn.pak
- %TEMP%\is-szlpdg70qv.tmp\ca.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ca.pak
- %TEMP%\is-szlpdg70qv.tmp\cs.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\cs.pak
- %TEMP%\is-szlpdg70qv.tmp\da.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\da.pak
- %TEMP%\is-szlpdg70qv.tmp\de.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\de.pak
- %TEMP%\is-szlpdg70qv.tmp\el.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\el.pak
- %TEMP%\is-szlpdg70qv.tmp\en-gb.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\en-gb.pak
- %TEMP%\is-szlpdg70qv.tmp\en-us.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\en-us.pak
- %TEMP%\is-szlpdg70qv.tmp\es-419.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\es-419.pak
- %TEMP%\is-szlpdg70qv.tmp\es.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\es.pak
- %TEMP%\is-szlpdg70qv.tmp\et.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\et.pak
- %TEMP%\is-szlpdg70qv.tmp\fa.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\fa.pak
- %TEMP%\is-szlpdg70qv.tmp\fi.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\fi.pak
- %TEMP%\is-szlpdg70qv.tmp\fil.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\fil.pak
- %TEMP%\is-szlpdg70qv.tmp\fr.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\fr.pak
- %TEMP%\is-szlpdg70qv.tmp\gu.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\gu.pak
- %TEMP%\is-szlpdg70qv.tmp\he.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\he.pak
- %TEMP%\is-szlpdg70qv.tmp\hi.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\hi.pak
- %TEMP%\is-szlpdg70qv.tmp\hr.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\hr.pak
- %TEMP%\is-szlpdg70qv.tmp\hu.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\hu.pak
- %TEMP%\is-szlpdg70qv.tmp\id.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\id.pak
- %TEMP%\is-szlpdg70qv.tmp\it.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\it.pak
- %TEMP%\is-szlpdg70qv.tmp\ja.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ja.pak
- %TEMP%\is-szlpdg70qv.tmp\kn.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\kn.pak
- %TEMP%\is-szlpdg70qv.tmp\ko.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ko.pak
- %TEMP%\is-szlpdg70qv.tmp\lt.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\lt.pak
- %TEMP%\is-szlpdg70qv.tmp\lv.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\lv.pak
- %TEMP%\is-szlpdg70qv.tmp\ml.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ml.pak
- %TEMP%\is-szlpdg70qv.tmp\mr.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\mr.pak
- %TEMP%\is-szlpdg70qv.tmp\ms.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ms.pak
- %TEMP%\is-szlpdg70qv.tmp\nb.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\nb.pak
- %TEMP%\is-szlpdg70qv.tmp\nl.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\nl.pak
- %TEMP%\is-szlpdg70qv.tmp\pl.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\pl.pak
- %TEMP%\is-szlpdg70qv.tmp\pt-br.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\pt-br.pak
- %TEMP%\is-szlpdg70qv.tmp\pt-pt.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\pt-pt.pak
- %TEMP%\is-szlpdg70qv.tmp\ro.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ro.pak
- %TEMP%\is-szlpdg70qv.tmp\ru.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ru.pak
- %TEMP%\is-szlpdg70qv.tmp\sk.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\sk.pak
- %TEMP%\is-szlpdg70qv.tmp\sl.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\sl.pak
- %TEMP%\is-szlpdg70qv.tmp\sr.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\sr.pak
- %TEMP%\is-szlpdg70qv.tmp\sv.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\sv.pak
- %TEMP%\is-szlpdg70qv.tmp\sw.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\sw.pak
- %TEMP%\is-szlpdg70qv.tmp\ta.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\ta.pak
- %TEMP%\is-szlpdg70qv.tmp\te.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\te.pak
- %TEMP%\is-szlpdg70qv.tmp\th.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\th.pak
- %TEMP%\is-szlpdg70qv.tmp\tr.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\tr.pak
- %TEMP%\is-szlpdg70qv.tmp\uk.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\uk.pak
- %TEMP%\is-szlpdg70qv.tmp\vi.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\vi.pak
- %TEMP%\is-szlpdg70qv.tmp\zh-cn.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\zh-cn.pak
- %TEMP%\is-szlpdg70qv.tmp\zh-tw.pak
- %LOCALAPPDATA%\proutilmegasoftlite\locales\zh-tw.pak
- %TEMP%\is-szlpdg70qv.tmp\app-update.yml
- %LOCALAPPDATA%\proutilmegasoftlite\resources\app-update.yml
- %TEMP%\is-szlpdg70qv.tmp\app.asar
- %LOCALAPPDATA%\proutilmegasoftlite\resources\app.asar
- %TEMP%\is-szlpdg70qv.tmp\libegl_62720a.dll
- %LOCALAPPDATA%\proutilmegasoftlite\swiftshader\libegl.dll
- %TEMP%\is-szlpdg70qv.tmp\libglesv2_82bc23.dll
- %LOCALAPPDATA%\proutilmegasoftlite\swiftshader\libglesv2.dll
- %APPDATA%\setup.txt
Network activity
Connects to
- 'we###elegram.ug':443
TCP
Other
- 'we###elegram.ug':443
UDP
- DNS ASK we###elegram.ug
Miscellaneous
Creates and executes the following
- '%TEMP%\is-5t1zbetbm4.tmp\<File name>.tmp' /SL5="$1E01D6,55373971,893440,<Full path to file>"
- '%LOCALAPPDATA%\proutilmegasoftlite\grape.exe'
- '%LOCALAPPDATA%\proutilmegasoftlite\grape.exe' --type=gpu-process --field-trial-handle=1772,8813716034084484243,15763297175595092453,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-pre...
- '%LOCALAPPDATA%\proutilmegasoftlite\grape.exe' --type=utility --field-trial-handle=1772,8813716034084484243,15763297175595092453,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US ...