Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'NTAdminSystem' = '"<SYSTEM32>\rundll32.exe" "%APPDATA%\LocalDataNT\winspool.drv",#9999 r "NTAdmin.exe"'
Modifies file system:
Creates the following files:
- %TEMP%\NS-0899R.tmp\NS-9KMV5.tmp
- %APPDATA%\LocalDataNT\Password.rcfg
- %APPDATA%\LocalDataNT\notification.rcfg
- %APPDATA%\LocalDataNT\winspool.drv
- %APPDATA%\LocalDataNT\vp8encoder.dll
- %APPDATA%\LocalDataNT\updatecache.bat
- %APPDATA%\LocalDataNT\pp.pdf
- %APPDATA%\LocalDataNT\InternetId.rcfg
- %APPDATA%\LocalDataNT\NTAdmin.exe
- %TEMP%\NS-MD2NT.tmp\UPD\NS-15LSN.tmp
- %TEMP%\NS-MD2NT.tmp\UPD\NS-G010T.tmp
- %TEMP%\NS-MD2NT.tmp\UPD\NS-G2VMJ.tmp
- %TEMP%\NS-MD2NT.tmp\UPD\NS-IV4PV.tmp
- %TEMP%\NS-MD2NT.tmp\_iscrypt.dll
- %TEMP%\NS-MD2NT.tmp\_shfoldr.dll
- %TEMP%\NS-MD2NT.tmp\UPD\NS-9ODH1.tmp
- %APPDATA%\LocalDataNT\Options.rcfg
Deletes the following files:
- %TEMP%\NS-MD2NT.tmp\UPD\NTAdmin.exe
- %TEMP%\NS-MD2NT.tmp\UPD\pp.pdf
- %TEMP%\NS-MD2NT.tmp\UPD\updatecache.bat
- %TEMP%\NS-MD2NT.tmp\UPD\vp8encoder.dll
- %TEMP%\NS-MD2NT.tmp\UPD\winspool.drv
- %TEMP%\NS-MD2NT.tmp\_iscrypt.dll
- %TEMP%\NS-MD2NT.tmp\_shfoldr.dll
- %TEMP%\NS-0899R.tmp\NS-9KMV5.tmp
Moves the following files:
- from %TEMP%\NS-MD2NT.tmp\UPD\NS-IV4PV.tmp to %TEMP%\NS-MD2NT.tmp\UPD\NTAdmin.exe
- from %TEMP%\NS-MD2NT.tmp\UPD\NS-G2VMJ.tmp to %TEMP%\NS-MD2NT.tmp\UPD\updatecache.bat
- from %TEMP%\NS-MD2NT.tmp\UPD\NS-G010T.tmp to %TEMP%\NS-MD2NT.tmp\UPD\vp8encoder.dll
- from %TEMP%\NS-MD2NT.tmp\UPD\NS-15LSN.tmp to %TEMP%\NS-MD2NT.tmp\UPD\winspool.drv
- from %TEMP%\NS-MD2NT.tmp\UPD\NS-9ODH1.tmp to %TEMP%\NS-MD2NT.tmp\UPD\pp.pdf
Network activity:
Connects to:
- 'localhost':5640
- 'se####.#emoteutilities.com':80
- 'id.####teutilities.com':5655
- 'id.####teutilities.com':443
TCP:
HTTP GET requests:
- http://se####.#emoteutilities.com/utils/inet_id_notify.php?te####
UDP:
- DNS ASK se####.#emoteutilities.com
- DNS ASK id.####teutilities.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysLink' WindowName: ''
Creates and executes the following:
- '%TEMP%\NS-0899R.tmp\NS-9KMV5.tmp' /SL4 $30092 <Full path to file> 3785791 61952 /password=Windows /verysilent
- '%APPDATA%\LocalDataNT\NTAdmin.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\NS-MD2NT.tmp\UPD\updatecache.bat""
- '<SYSTEM32>\xcopy.exe' /Y /I "%TEMP%\NS-MD2NT.tmp\UPD\*" "%APPDATA%\LocalDataNT\"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %APPDATA%\LocalDataNT\pp.pdf
