Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\imtbl\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\immutable-launcher\Gods Unchained.exe" "%1"'
Malicious functions
Injects code into
the following user processes:
- gods unchained.exe
Modifies file system
Creates the following files
- %TEMP%\nsw9a6b.tmp\system.dll
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7-zip.dll
- %LOCALAPPDATA%\programs\immutable-launcher\libglesv2.dll
- %LOCALAPPDATA%\programs\immutable-launcher\libegl.dll
- %LOCALAPPDATA%\programs\immutable-launcher\gods unchained.exe
- %LOCALAPPDATA%\programs\immutable-launcher\ffmpeg.dll
- %LOCALAPPDATA%\programs\immutable-launcher\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\immutable-launcher\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\immutable-launcher\snapshot_blob.bin
- %LOCALAPPDATA%\programs\immutable-launcher\resources\electron.asar
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\package.json
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\index.js
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\readme.txt
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\license.txt
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\lang\en.ttt
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\history.txt
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\descript.ion
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app-update.yml
- %LOCALAPPDATA%\programs\immutable-launcher\resources.pak
- %LOCALAPPDATA%\programs\immutable-launcher\natives_blob.bin
- %LOCALAPPDATA%\programs\immutable-launcher\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\vi.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\uk.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\tr.pak
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7-zip32.dll
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7z.exe
- %APPDATA%\immutable-launcher\.updaterid
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7z.sfx
- %APPDATA%\immutable-launcher\cookies
- %APPDATA%\immutable-launcher\cookies-journal
- %APPDATA%\immutable-launcher\gpucache\data_3
- %APPDATA%\immutable-launcher\gpucache\data_2
- %APPDATA%\immutable-launcher\gpucache\data_1
- %APPDATA%\immutable-launcher\gpucache\data_0
- %APPDATA%\immutable-launcher\gpucache\index
- %APPDATA%\immutable-launcher\cache\data_3
- %APPDATA%\immutable-launcher\cache\data_2
- %APPDATA%\immutable-launcher\cache\data_1
- %APPDATA%\immutable-launcher\cache\data_0
- %APPDATA%\immutable-launcher\cache\index
- %APPDATA%\immutable-launcher\settings
- %APPDATA%\immutable-launcher\code cache\js\index-dir\temp-index
- %APPDATA%\immutable-launcher\code cache\js\index
- %APPDATA%\immutable-launcher\logs\main.log
- %HOMEPATH%\desktop\gods unchained.lnk
- %TEMP%\nsw9a6b.tmp\winshell.dll
- %APPDATA%\microsoft\windows\start menu\programs\gods unchained.lnk
- %LOCALAPPDATA%\programs\immutable-launcher\uninstall gods unchained.exe
- %LOCALAPPDATA%\immutable-launcher-updater\installer.exe
- %LOCALAPPDATA%\programs\immutable-launcher\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\immutable-launcher\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\immutable-launcher\resources\elevate.exe
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7zcon.sfx
- %LOCALAPPDATA%\programs\immutable-launcher\locales\th.pak
- %LOCALAPPDATA%\programs\immutable-launcher\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7z.dll
- %LOCALAPPDATA%\programs\immutable-launcher\locales\te.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\fil.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\fa.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\et.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\es.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\es-419.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\en-us.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\en-gb.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\el.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\de.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\da.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\cs.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ca.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\bn.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\bg.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ar.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\am.pak
- %LOCALAPPDATA%\programs\immutable-launcher\licenses.chromium.html
- %LOCALAPPDATA%\programs\immutable-launcher\license.electron.txt
- %LOCALAPPDATA%\programs\immutable-launcher\icudtl.dat
- %LOCALAPPDATA%\programs\immutable-launcher\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\immutable-launcher\chrome_100_percent.pak
- %TEMP%\nsw9a6b.tmp\nsis7z.dll
- %TEMP%\nsw9a6b.tmp\app-64.7z
- %TEMP%\nsw9a6b.tmp\nsprocess.dll
- %TEMP%\nsw9a6b.tmp\spiderbanner.dll
- %TEMP%\nsw9a6b.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\immutable-launcher\locales\fi.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\fr.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\sw.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\gu.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\sv.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\sr.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\sl.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\sk.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ru.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ro.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\pt-br.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\pl.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\nl.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\nb.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ms.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\mr.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ml.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\lv.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\lt.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ko.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\kn.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ja.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\it.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\id.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\hu.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\hr.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\hi.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\he.pak
- %LOCALAPPDATA%\programs\immutable-launcher\locales\ta.pak
- %APPDATA%\immutable-launcher\c2cee393-4d7b-48a9-b4ed-da4d21ce991b.tmp
Deletes the following files
- %TEMP%\nsw9a6b.tmp\app-64.7z
- %TEMP%\nsw9a6b.tmp\nsis7z.dll
- %TEMP%\nsw9a6b.tmp\nsprocess.dll
- %TEMP%\nsw9a6b.tmp\spiderbanner.dll
- %TEMP%\nsw9a6b.tmp\stdutils.dll
- %TEMP%\nsw9a6b.tmp\system.dll
- %TEMP%\nsw9a6b.tmp\winshell.dll
- %APPDATA%\immutable-launcher\network persistent state~rf134a68.tmp
Moves the following files
- from %APPDATA%\immutable-launcher\code cache\js\index-dir\temp-index to %APPDATA%\immutable-launcher\code cache\js\index-dir\the-real-index
- from %APPDATA%\immutable-launcher\c2cee393-4d7b-48a9-b4ed-da4d21ce991b.tmp to %APPDATA%\immutable-launcher\network persistent state
- from %APPDATA%\immutable-launcher\network persistent state to %APPDATA%\immutable-launcher\network persistent state~rf134a68.tmp
Network activity
Connects to
- 'ap########ncher.s3.amazonaws.com':443
- 'ma####.###ktop.godsunchained.com':443
- 'clients2.google.com':443
- 'x.##2.us':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'clients2.google.com':443
- 'ma####.###ktop.godsunchained.com':443
- 'ap########ncher.s3.amazonaws.com':443
UDP
- DNS ASK clients2.google.com
- DNS ASK ma####.###ktop.godsunchained.com
- DNS ASK ap########ncher.s3.amazonaws.com
- DNS ASK x.##2.us
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\immutable-launcher'
Creates and executes the following
- '%LOCALAPPDATA%\programs\immutable-launcher\gods unchained.exe'
- '%LOCALAPPDATA%\programs\immutable-launcher\gods unchained.exe' --type=gpu-process --field-trial-handle=1124,11148127434368090497,6772210112090458647,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAAAgAAAAAAA...
- '%LOCALAPPDATA%\programs\immutable-launcher\gods unchained.exe' --type=renderer --field-trial-handle=1124,11148127434368090497,6772210112090458647,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --lang=en-US --app-path="%LOCALAPPDATA%\Prog...
- '%LOCALAPPDATA%\programs\immutable-launcher\gods unchained.exe' --type=gpu-process --field-trial-handle=1124,11148127434368090497,6772210112090458647,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled -...
