Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'seepageinflicting' = '"%ProgramFiles%\increments\maitre.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'inflictingseepage' = '"%ProgramFiles%\increments\maitre.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'seepage' = '"%ProgramFiles%\Totting\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'inflictinginflicting' = '"%ProgramFiles%\Cherished\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'geron' = '"%ProgramFiles%\Totting\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'brink' = '"%ProgramFiles%\corwin\brink.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'seepageseepage' = '"%ProgramFiles%\Cherished\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bindingschangelings' = '"%ProgramFiles%\increments\maitre.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'changelings' = '"%ProgramFiles%\Totting\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bindings' = '"%ProgramFiles%\Totting\deform.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'changelingsbindings' = '"%ProgramFiles%\increments\maitre.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'inflicting' = '"%ProgramFiles%\Totting\deform.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'changelingschangelings' = '"%ProgramFiles%\Cherished\deform.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bindingsbindings' = '"%ProgramFiles%\Cherished\deform.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\lazolazo.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\lazo.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\indwelling\indwelling.exe
- %TEMP%\nsy7.tmp\AccessControl.dll
- %ProgramFiles%\corwin\brink.exe
- %ProgramFiles%\Cherished\maitre.exe
- <LS_APPDATA>\maitre.exe
- %TEMP%\nsn5.tmp\SimpleFC.dll
- %ProgramFiles%\Cherished\deform.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\eCw2GP0GP1GP71oBT22eCw5GP[1].asp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\eCw2GP0GP1GP71oBT22eCw5GP[1].asp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\2-eCw2GP0GP1GP71oBT22eCw5GP[1].asp
- %TEMP%\nsbB.tmp\nsD.tmp
- %WINDIR%\initiated.exe
- %TEMP%\nsbB.tmp\nsExec.dll
- %TEMP%\nsbC.tmp\ShellLink.dll
- <LS_APPDATA>\deform.exe
- %TEMP%\nsp2.tmp\124487.exe
- %TEMP%\nsp2.tmp\NMdominguez.exe
- %TEMP%\nsp2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nsp2.tmp\104059.exe
- %TEMP%\nsp2.tmp\23684.exe
- %TEMP%\nsp2.tmp\33278.exe
- %TEMP%\nsp2.tmp\52053.exe
- %ProgramFiles%\increments\increments.exe
- %ProgramFiles%\increments\maitre.dll
- %ProgramFiles%\increments\maitre.exe
- %ProgramFiles%\Totting\deform.exe
- %TEMP%\nsp2.tmp\112492.exe
- %ProgramFiles%\Totting\Totting.exe
- %ProgramFiles%\Totting\deform.dll
Deletes the following files:
- %TEMP%\nsbC.tmp\ShellLink.dll
- %TEMP%\nsy7.tmp\AccessControl.dll
- %TEMP%\nsn5.tmp\SimpleFC.dll
Network activity:
Connects to:
- 'yo####everally.pw':80
- 'localhost':1047
- 'localhost':1042
- 'localhost':1038
- 'localhost':1040
TCP:
HTTP GET requests:
- http://www.yo####everally.pw/2-eCw2GP0GP1GP71oBT22eCw5GP.asp?ea############################################## via yo####everally.pw
- http://www.yo####everally.pw/eCw2GP0GP1GP71oBT22eCw5GP.asp?co################################################# via yo####everally.pw
UDP:
- DNS ASK ww##.##delseverally.pw
- DNS ASK www.yo####everally.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "%ProgramFiles%\indwelling\indwelling.exe" "k65890172"
- '%TEMP%\nsp2.tmp\112492.exe'
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "%ProgramFiles%\Cherished\deform.exe" "65890172"
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "%ProgramFiles%\Cherished\maitre.exe" "6589017265890172"
- '%TEMP%\nsp2.tmp\104059.exe'
- '%TEMP%\nsbB.tmp\nsD.tmp' taskkill /im chrome.exe
- '%ProgramFiles%\corwin\brink.exe'
- '%TEMP%\nsp2.tmp\52053.exe'
- '%ProgramFiles%\Cherished\maitre.exe'
- '%TEMP%\nsp2.tmp\124487.exe'
- '%ProgramFiles%\Totting\deform.exe'
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "%ProgramFiles%\Totting\deform.exe" "6536567"
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "%ProgramFiles%\increments\maitre.exe" "65365676536567"
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "<LS_APPDATA>\maitre.exe" "1715719017157190"
- '%ProgramFiles%\Cherished\deform.exe'
- '%TEMP%\nsp2.tmp\33278.exe'
- '%TEMP%\nsp2.tmp\NMdominguez.exe' "<LS_APPDATA>\deform.exe" "17157190"
