Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM VALORANT-Win64-Shipping.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\mntemp
- %WINDIR%\temp\tar9806.tmp
- %WINDIR%\temp\cab9805.tmp
- %WINDIR%\temp\tar8223.tmp
- %WINDIR%\temp\cab8222.tmp
- %WINDIR%\temp\tar81c4.tmp
- %WINDIR%\temp\cab81c3.tmp
- %WINDIR%\temp\tar6c20.tmp
- %WINDIR%\temp\cab6c1f.tmp
- %WINDIR%\temp\tar6b63.tmp
- %WINDIR%\temp\cab6b62.tmp
- %WINDIR%\temp\tar5522.tmp
- %WINDIR%\temp\cab5521.tmp
- %WINDIR%\temp\tar5475.tmp
- %WINDIR%\temp\cab5474.tmp
- %WINDIR%\temp\tar3db8.tmp
- %WINDIR%\temp\cab3db7.tmp
- %WINDIR%\temp\tar3d49.tmp
- %WINDIR%\temp\cab3d48.tmp
- %WINDIR%\temp\tar3cca.tmp
- %WINDIR%\temp\cab3cc9.tmp
- %WINDIR%\temp\tar3c8a.tmp
- %WINDIR%\temp\cab3c89.tmp
- %WINDIR%\temp\tar2678.tmp
- %WINDIR%\temp\cab2677.tmp
- %WINDIR%\temp\tar2619.tmp
- %WINDIR%\temp\cab2618.tmp
- %WINDIR%\temp\tarfc9.tmp
- %WINDIR%\temp\cabfc8.tmp
- nul
- %WINDIR%\temp\cabdb6d.tmp
- %WINDIR%\temp\tardb6e.tmp
Deletes the following files
- %WINDIR%\temp\cabfc8.tmp
- %WINDIR%\temp\tar9806.tmp
- %WINDIR%\temp\cab9805.tmp
- %WINDIR%\temp\tar8223.tmp
- %WINDIR%\temp\cab8222.tmp
- %WINDIR%\temp\tar81c4.tmp
- %WINDIR%\temp\cab81c3.tmp
- %WINDIR%\temp\tar6c20.tmp
- %WINDIR%\temp\cab6c1f.tmp
- %WINDIR%\temp\tar6b63.tmp
- %WINDIR%\temp\cab6b62.tmp
- %WINDIR%\temp\tar5522.tmp
- %WINDIR%\temp\cab5521.tmp
- %WINDIR%\temp\tar5475.tmp
- %WINDIR%\temp\cab5474.tmp
- %WINDIR%\temp\tar3db8.tmp
- %WINDIR%\temp\cab3db7.tmp
- %WINDIR%\temp\tar3d49.tmp
- %WINDIR%\temp\cab3d48.tmp
- %WINDIR%\temp\tar3cca.tmp
- %WINDIR%\temp\cab3cc9.tmp
- %WINDIR%\temp\tar3c8a.tmp
- %WINDIR%\temp\cab3c89.tmp
- %WINDIR%\temp\tar2678.tmp
- %WINDIR%\temp\cab2677.tmp
- %WINDIR%\temp\tar2619.tmp
- %WINDIR%\temp\cab2618.tmp
- %WINDIR%\temp\tarfc9.tmp
- %WINDIR%\temp\cabdb6d.tmp
- %WINDIR%\temp\tardb6e.tmp
Network activity
Connects to
- 'localhost':49185
- 'localhost':49187
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: '䑉㩁儠極正猠慴瑲'
- ClassName: '' WindowName: '敍潭祲嘠敩敷r'
- ClassName: '' WindowName: '牐捯獥楌瑳'
- ClassName: '' WindowName: '獋畄灭牥'
- ClassName: '' WindowName: '呈偔䐠扥杵敧r'
- ClassName: '' WindowName: '汏祬扄g瑎畑牥䥹普牯慭楴湯牐捯獥s'
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM VALORANT-Win64-Shipping.exe >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /c sc delete vgc
- '<SYSTEM32>\sc.exe' delete vgc
- '<SYSTEM32>\cmd.exe' /c sc delete vgk
- '<SYSTEM32>\sc.exe' delete vgk
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
