Technical Information
Malicious functions
Patches code
in dll
- updater_loader.exe process, Wldp.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\_mei24722\pythonwin\mfc140u.dll
- %TEMP%\_mei24722\pythonwin\win32ui.pyd
- %TEMP%\_mei24722\vcruntime140.dll
- %TEMP%\_mei24722\_asyncio.pyd
- %TEMP%\_mei24722\_bz2.pyd
- %TEMP%\_mei24722\_cffi_backend.cp39-win_amd64.pyd
- %TEMP%\_mei24722\_ctypes.pyd
- %TEMP%\_mei24722\_decimal.pyd
- %TEMP%\_mei24722\_hashlib.pyd
- %TEMP%\_mei24722\_lzma.pyd
- %TEMP%\_mei24722\_multiprocessing.pyd
- %TEMP%\_mei24722\_overlapped.pyd
- %TEMP%\_mei24722\_queue.pyd
- %TEMP%\_mei24722\_socket.pyd
- %TEMP%\_mei24722\_ssl.pyd
- %TEMP%\_mei24722\_uuid.pyd
- %TEMP%\_mei24722\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei24722\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei24722\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei24722\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei24722\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei24722\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei24722\base_library.zip
- %TEMP%\_mei24722\bcrypt\_bcrypt.pyd
- %TEMP%\_mei24722\certifi\cacert.pem
- %TEMP%\_mei24722\charset_normalizer\md.cp39-win_amd64.pyd
- %TEMP%\_mei24722\charset_normalizer\md__mypyc.cp39-win_amd64.pyd
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\installer
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\license
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\license.apache
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\license.bsd
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\license.psf
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\metadata
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\record
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\wheel
- %TEMP%\_mei24722\cryptography-37.0.2.dist-info\top_level.txt
- %TEMP%\_mei24722\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei24722\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei24722\enc_loader.exe
- %TEMP%\_mei24722\libcrypto-1_1.dll
- %TEMP%\_mei24722\libffi-7.dll
- %TEMP%\_mei24722\libssl-1_1.dll
- %TEMP%\_mei24722\psutil\_psutil_windows.cp39-win_amd64.pyd
- %TEMP%\_mei24722\pyarmor_runtime_000000\__init__.py
- %TEMP%\_mei24722\pyarmor_runtime_000000\pyarmor_runtime.pyd
- %TEMP%\_mei24722\pyexpat.pyd
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\installer
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\license.md
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\metadata
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\record
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\wheel
- %TEMP%\_mei24722\pyreadline3-3.5.4.dist-info\top_level.txt
- %TEMP%\_mei24722\python3.dll
- %TEMP%\_mei24722\python39.dll
- %TEMP%\_mei24722\pywin32_system32\pythoncom39.dll
- %TEMP%\_mei24722\pywin32_system32\pywintypes39.dll
- %TEMP%\_mei24722\select.pyd
- %TEMP%\_mei24722\ucrtbase.dll
- %TEMP%\_mei24722\unicodedata.pyd
- %TEMP%\_mei24722\vmblack\black_baseboard_seria.txt
- %TEMP%\_mei24722\vmblack\black_biosserial.txt
- %TEMP%\_mei24722\vmblack\black_cpu.txt
- %TEMP%\_mei24722\vmblack\black_disk.txt
- %TEMP%\_mei24722\vmblack\black_gpu.txt
- %TEMP%\_mei24722\vmblack\black_hwid.txt
- %TEMP%\_mei24722\vmblack\black_hw_profile_guid.txt
- %TEMP%\_mei24722\vmblack\black_mac_address.txt
- %TEMP%\_mei24722\vmblack\black_machine_guid.txt
- %TEMP%\_mei24722\vmblack\black_manufacture.txt
- %TEMP%\_mei24722\vmblack\black_pc_name.txt
- %TEMP%\_mei24722\vmblack\black_platform.txt
- %TEMP%\_mei24722\vmblack\black_processes.txt
- %TEMP%\_mei24722\vmblack\black_users.txt
- %TEMP%\_mei24722\vmblack\black_ip.txt
- %TEMP%\_mei24722\win32\_win32sysloader.pyd
- %TEMP%\_mei24722\win32\win32api.pyd
- %TEMP%\_mei24722\win32\win32evtlog.pyd
- %TEMP%\_mei24722\win32\win32trace.pyd
- %TEMP%\_mei24722\zstandard\_cffi.cp39-win_amd64.pyd
- %TEMP%\_mei24722\zstandard\backend_c.cp39-win_amd64.pyd
- %TEMP%\gen_py\3.9\__init__.py
- %TEMP%\gen_py\3.9\dicts.dat
- %TEMP%\updater_loader.exe
Network activity
Connects to
- 'ip##fo.io':443
TCP
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Creates and executes the following
- '%TEMP%\updater_loader.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\wbem\WMIC.exe csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\wbem\WMIC.exe csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
