Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\comtress\shell\open\command] '' = '"<Full path to file>" "%1"'
Modifies file system
Creates the following files
- %TEMP%\_mei21082\vcruntime140.dll
- %TEMP%\_mei21082\vcruntime140_1.dll
- %TEMP%\_mei21082\_asyncio.pyd
- %TEMP%\_mei21082\_bz2.pyd
- %TEMP%\_mei21082\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei21082\_ctypes.pyd
- %TEMP%\_mei21082\_decimal.pyd
- %TEMP%\_mei21082\_elementtree.pyd
- %TEMP%\_mei21082\_hashlib.pyd
- %TEMP%\_mei21082\_lzma.pyd
- %TEMP%\_mei21082\_multiprocessing.pyd
- %TEMP%\_mei21082\_overlapped.pyd
- %TEMP%\_mei21082\_queue.pyd
- %TEMP%\_mei21082\_socket.pyd
- %TEMP%\_mei21082\_ssl.pyd
- %TEMP%\_mei21082\_uuid.pyd
- %TEMP%\_mei21082\_wmi.pyd
- %TEMP%\_mei21082\aiohttp\_http_parser.cp313-win_amd64.pyd
- %TEMP%\_mei21082\aiohttp\_http_writer.cp313-win_amd64.pyd
- %TEMP%\_mei21082\aiohttp\_websocket\mask.cp313-win_amd64.pyd
- %TEMP%\_mei21082\aiohttp\_websocket\reader_c.cp313-win_amd64.pyd
- %TEMP%\_mei21082\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-fibers-l1-1-1.dll
- %TEMP%\_mei21082\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei21082\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %TEMP%\_mei21082\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei21082\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei21082\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei21082\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-sysinfo-l1-2-0.dll
- %TEMP%\_mei21082\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei21082\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei21082\attrs-25.4.0.dist-info\installer
- %TEMP%\_mei21082\attrs-25.4.0.dist-info\metadata
- %TEMP%\_mei21082\attrs-25.4.0.dist-info\record
- %TEMP%\_mei21082\attrs-25.4.0.dist-info\wheel
- %TEMP%\_mei21082\attrs-25.4.0.dist-info\licenses\license
- %TEMP%\_mei21082\base_library.zip
- %TEMP%\_mei21082\certifi\cacert.pem
- %TEMP%\_mei21082\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\_mei21082\clr_loader\ffi\dlls\x86\clrloader.dll
- %TEMP%\_mei21082\frozenlist\_frozenlist.cp313-win_amd64.pyd
- %TEMP%\_mei21082\gui\favicon.ico
- %TEMP%\_mei21082\gui\index.html
- %TEMP%\_mei21082\gui\tc2.png
- %TEMP%\_mei21082\gui\update.html
- %TEMP%\_mei21082\libcrypto-3.dll
- %TEMP%\_mei21082\libffi-8.dll
- %TEMP%\_mei21082\libssl-3.dll
- %TEMP%\_mei21082\multidict\_multidict.cp313-win_amd64.pyd
- %TEMP%\_mei21082\propcache\_helpers_c.cp313-win_amd64.pyd
- %TEMP%\_mei21082\psutil\_psutil_windows.pyd
- %TEMP%\_mei21082\pyexpat.pyd
- %TEMP%\_mei21082\python3.dll
- %TEMP%\_mei21082\python313.dll
- %TEMP%\_mei21082\pythonnet\runtime\python.runtime.dll
- %TEMP%\_mei21082\select.pyd
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei21082\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei21082\ucrtbase.dll
- %TEMP%\_mei21082\unicodedata.pyd
- %TEMP%\_mei21082\webview\js\api.js
- %TEMP%\_mei21082\webview\js\customize.js
- %TEMP%\_mei21082\webview\js\finish.js
- %TEMP%\_mei21082\webview\js\lib\dom_json.js
- %TEMP%\_mei21082\webview\js\lib\polyfill.js
- %TEMP%\_mei21082\webview\js\state.js
- %TEMP%\_mei21082\webview\lib\microsoft.web.webview2.core.dll
- %TEMP%\_mei21082\webview\lib\microsoft.web.webview2.winforms.dll
- %TEMP%\_mei21082\webview\lib\webbrowserinterop.x64.dll
- %TEMP%\_mei21082\webview\lib\webbrowserinterop.x86.dll
- %TEMP%\_mei21082\webview\lib\pywebview-android.jar
- %TEMP%\_mei21082\webview\lib\runtimes\win-arm64\native\webview2loader.dll
- %TEMP%\_mei21082\webview\lib\runtimes\win-x64\native\webview2loader.dll
- %TEMP%\_mei21082\webview\lib\runtimes\win-x86\native\webview2loader.dll
- %TEMP%\_mei21082\yarl\_quoting_c.cp313-win_amd64.pyd
- nul
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\tc2launcher\settings.json
- %LOCALAPPDATA%\tc2launcher\tc2_launcher_log.txt
- %TEMP%\48d576t5
Deletes following files that it created itself
- %TEMP%\48d576t5
Network activity
Connects to
- 'localhost':49694
- 'ap#.#ithub.com':443
- 'localhost':48564
- 'localhost':49700
- 'localhost':49702
TCP
HTTP GET requests
- http://12#.#.0.1:48564/tc2.png
Other
- 'localhost':49694
- 'ap#.#ithub.com':443
- 'localhost':49698
- 'localhost':49699
- 'localhost':49700
- 'localhost':49702
- 'gi##ub.com':443
UDP
- DNS ASK ap#.#ithub.com
- DNS ASK gi##ub.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)