Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Djvlespillenes' = '%TEMP%\Conversaziones\Brochen.exe'
Malicious functions
Patches code
in dll
- xzpvhtck.exe process, KERNEL32.dll module
- xzpvhtck.exe process, KERNELBASE.dll module
- xzpvhtck.exe process, RPCRT4.dll module
- xzpvhtck.exe process, ole32.dll module
- xzpvhtck.exe process, combase.dll module
- xzpvhtck.exe process, bcryptPrimitives.dll module
- xzpvhtck.exe process, CLBCatQ.DLL module
- xzpvhtck.exe process, bcrypt.dll module
- xzpvhtck.exe process, SCHANNEL.dll module
- xzpvhtck.exe process, mskeyprotect.dll module
- xzpvhtck.exe process, NTASN1.dll module
- xzpvhtck.exe process, CRYPT32.dll module
- xzpvhtck.exe process, RSAENH.dll module
- xzpvhtck.exe process, ncrypt.dll module
- xzpvhtck.exe process, ncryptsslp.dll module
in NTDLL dll
- xzpvhtck.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %APPDATA%\umaadeholdenhed\udgravning
- %APPDATA%\umaadeholdenhed\barothermohygrograph.sub
- %APPDATA%\umaadeholdenhed\highths
- %APPDATA%\umaadeholdenhed\incestens.ref
- %APPDATA%\umaadeholdenhed\skatteudvalg.arb
- %APPDATA%\umaadeholdenhed\udtrkkenes.rel
- %HOMEPATH%\unvilified.ini
- %TEMP%\callisto.ini
- %TEMP%\nsd4a0.tmp\system.dll
- %TEMP%\conversaziones\brochen.exe
- %LOCALAPPDATA%\google\chrome\user data\default\login data.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data.tmp
- %TEMP%\tmpuserdata\local state
- %TEMP%\tmpuserdata\default\secure preferences
- %TEMP%\tmpuserdata\default\network\cookies
- %TEMP%\tmpuserdata\crashpad\settings.dat
- %TEMP%\tmpuserdata\crashpad\throttle_store.dat
- %TEMP%\tmpuserdata\crashpadmetrics-active.pma
- %TEMP%\tmpuserdata\devtoolsactiveport
- %TEMP%\tmpuserdata\default\chrome_debug.log
- %TEMP%\tmpuserdata\default\code cache\js\index
- %TEMP%\tmpuserdata\default\code cache\wasm\index
- %TEMP%\tmpuserdata\default\gpucache\index
- %TEMP%\tmpuserdata\default\gpucache\data_0
- %TEMP%\tmpuserdata\default\gpucache\data_1
- %TEMP%\tmpuserdata\default\gpucache\data_2
- %TEMP%\tmpuserdata\default\gpucache\data_3
- %TEMP%\tmpuserdata\default\code cache\wasm\index-dir\temp-index
- %TEMP%\tmpuserdata\default\code cache\js\index-dir\temp-index
Deletes following files that it created itself
- %LOCALAPPDATA%\google\chrome\user data\default\login data.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data.tmp
- %TEMP%\tmpuserdata\crashpad\settings.dat
- %TEMP%\tmpuserdata\crashpad\throttle_store.dat
- %TEMP%\tmpuserdata\crashpadmetrics-active.pma
- %TEMP%\tmpuserdata\default\chrome_debug.log
- %TEMP%\tmpuserdata\default\code cache\js\index
- %TEMP%\tmpuserdata\default\code cache\js\index-dir\the-real-index
- %TEMP%\tmpuserdata\default\code cache\wasm\index
- %TEMP%\tmpuserdata\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\tmpuserdata\default\gpucache\data_0
- %TEMP%\tmpuserdata\default\gpucache\data_1
- %TEMP%\tmpuserdata\default\gpucache\data_2
- %TEMP%\tmpuserdata\default\gpucache\data_3
- %TEMP%\tmpuserdata\default\gpucache\index
- %TEMP%\tmpuserdata\default\network\cookies
- %TEMP%\tmpuserdata\default\secure preferences
- %TEMP%\tmpuserdata\devtoolsactiveport
- %TEMP%\tmpuserdata\local state
Moves the following files
- from %TEMP%\tmpuserdata\default\code cache\js\index-dir\temp-index to %TEMP%\tmpuserdata\default\code cache\js\index-dir\the-real-index
- from %TEMP%\tmpuserdata\default\code cache\wasm\index-dir\temp-index to %TEMP%\tmpuserdata\default\code cache\wasm\index-dir\the-real-index
Modifies the following files
Network activity
Connects to
- 'od.lk':443
- '23.##5.2.181':80
- 'we#.##endrive.com':443
- 'oc##.##arfieldtech.com':80
- '64.##.161.94':2404
- 'localhost':9222
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?49##############
- http://oc##.##arfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQCIbKCFWuN%2FgA%3D%3D
Other
- 'od.lk':443
- 'we#.##endrive.com':443
- '64.##.161.94':2404
UDP
- DNS ASK od.lk
- DNS ASK we#.##endrive.com
- DNS ASK oc##.##arfieldtech.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless