Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'NotisMonitor' = '<Full path to file>'
Modifies file system
Creates the following files
- %TEMP%\_mei17002\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
- %TEMP%\_mei17002\msvcp140.dll
- %TEMP%\_mei17002\pil\_avif.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pil\_imaging.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pil\_imagingcms.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pil\_imagingmath.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pil\_imagingtk.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pil\_webp.cp314-win_amd64.pyd
- %TEMP%\_mei17002\vcruntime140.dll
- %TEMP%\_mei17002\vcruntime140_1.dll
- %TEMP%\_mei17002\_asyncio.pyd
- %TEMP%\_mei17002\_bz2.pyd
- %TEMP%\_mei17002\_ctypes.pyd
- %TEMP%\_mei17002\_decimal.pyd
- %TEMP%\_mei17002\_elementtree.pyd
- %TEMP%\_mei17002\_hashlib.pyd
- %TEMP%\_mei17002\_lzma.pyd
- %TEMP%\_mei17002\_multiprocessing.pyd
- %TEMP%\_mei17002\_overlapped.pyd
- %TEMP%\_mei17002\_queue.pyd
- %TEMP%\_mei17002\_socket.pyd
- %TEMP%\_mei17002\_sqlite3.pyd
- %TEMP%\_mei17002\_ssl.pyd
- %TEMP%\_mei17002\_uuid.pyd
- %TEMP%\_mei17002\_wmi.pyd
- %TEMP%\_mei17002\_zstd.pyd
- %TEMP%\_mei17002\base_library.zip
- %TEMP%\_mei17002\certifi\cacert.pem
- %TEMP%\_mei17002\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei17002\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei17002\click-8.5.0.dist-info\installer
- %TEMP%\_mei17002\click-8.5.0.dist-info\metadata
- %TEMP%\_mei17002\click-8.5.0.dist-info\record
- %TEMP%\_mei17002\click-8.5.0.dist-info\wheel
- %TEMP%\_mei17002\click-8.5.0.dist-info\licenses\license.txt
- %TEMP%\_mei17002\config.json
- %TEMP%\_mei17002\flask-3.1.3.dist-info\installer
- %TEMP%\_mei17002\flask-3.1.3.dist-info\metadata
- %TEMP%\_mei17002\flask-3.1.3.dist-info\record
- %TEMP%\_mei17002\flask-3.1.3.dist-info\wheel
- %TEMP%\_mei17002\flask-3.1.3.dist-info\entry_points.txt
- %TEMP%\_mei17002\flask-3.1.3.dist-info\licenses\license.txt
- %TEMP%\_mei17002\itsdangerous-2.2.0.dist-info\installer
- %TEMP%\_mei17002\itsdangerous-2.2.0.dist-info\license.txt
- %TEMP%\_mei17002\itsdangerous-2.2.0.dist-info\metadata
- %TEMP%\_mei17002\itsdangerous-2.2.0.dist-info\record
- %TEMP%\_mei17002\itsdangerous-2.2.0.dist-info\wheel
- %TEMP%\_mei17002\libcrypto-3.dll
- %TEMP%\_mei17002\libffi-8.dll
- %TEMP%\_mei17002\libssl-3.dll
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\installer
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\metadata
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\record
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\wheel
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\licenses\license.txt
- %TEMP%\_mei17002\markupsafe-3.0.3.dist-info\top_level.txt
- %TEMP%\_mei17002\markupsafe\_speedups.cp314-win_amd64.pyd
- %TEMP%\_mei17002\pyexpat.pyd
- %TEMP%\_mei17002\python314.dll
- %TEMP%\_mei17002\pythonwin\win32ui.pyd
- %TEMP%\_mei17002\pywin32_system32\pythoncom314.dll
- %TEMP%\_mei17002\pywin32_system32\pywintypes314.dll
- %TEMP%\_mei17002\select.pyd
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei17002\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei17002\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei17002\sqlite3.dll
- %TEMP%\_mei17002\unicodedata.pyd
- %TEMP%\_mei17002\werkzeug-3.1.8.dist-info\installer
- %TEMP%\_mei17002\werkzeug-3.1.8.dist-info\metadata
- %TEMP%\_mei17002\werkzeug-3.1.8.dist-info\record
- %TEMP%\_mei17002\werkzeug-3.1.8.dist-info\wheel
- %TEMP%\_mei17002\werkzeug-3.1.8.dist-info\licenses\license.txt
- %TEMP%\_mei17002\win32\_win32sysloader.pyd
- %TEMP%\_mei17002\win32\win32api.pyd
- %TEMP%\_mei17002\win32\win32clipboard.pyd
- %TEMP%\_mei17002\win32\win32console.pyd
- %TEMP%\_mei17002\win32\win32event.pyd
- %TEMP%\_mei17002\win32\win32gui.pyd
- %TEMP%\_mei17002\win32\win32pdh.pyd
- %TEMP%\_mei17002\win32\win32process.pyd
- %TEMP%\_mei17002\win32\win32trace.pyd
- %TEMP%\_mei17002\win32com\adsi\adsi.pyd
- %TEMP%\_mei17002\win32com\authorization\authorization.pyd
- %TEMP%\_mei17002\win32com\axcontrol\axcontrol.pyd
- %TEMP%\_mei17002\win32com\axdebug\axdebug.pyd
- %TEMP%\_mei17002\win32com\axscript\axscript.pyd
- %TEMP%\_mei17002\win32com\bits\bits.pyd
- %TEMP%\_mei17002\win32com\directsound\directsound.pyd
- %TEMP%\_mei17002\win32com\ifilter\ifilter.pyd
- %TEMP%\_mei17002\win32com\internet\internet.pyd
- %TEMP%\_mei17002\win32com\mapi\exchange.pyd
- %TEMP%\_mei17002\win32com\mapi\mapi.pyd
- %TEMP%\_mei17002\win32com\propsys\propsys.pyd
- %TEMP%\_mei17002\win32com\shell\shell.pyd
- %TEMP%\_mei17002\win32com\taskscheduler\taskscheduler.pyd
- %TEMP%\notis-monitor.log
Network activity
Connects to
- 'sc####shub.world':8787
TCP
HTTP POST requests
UDP
- DNS ASK sc####shub.world
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)