Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'tlbyxzn' = '"%APPDATA%\Microsoft\Cwoega\cwoega.exe"'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\bttgflmy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\bttgflmy] 'ImagePath' = '%APPDATA%\Microsoft\Cwoega\cwoega.exe /D'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\ping.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
- firefox.exe process, dnsapi.dll module
- firefox.exe process, wininet.dll module
- firefox.exe process, iphlpapi.dll module
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\cwoega\cwoega.exe
- %APPDATA%\microsoft\cwoega\cwoeg.dll
- %APPDATA%\microsoft\cwoega\cwoega32.dll
- C:\users\inhhq.bzp
- C:\users\rcx789e.tmp
- C:\users\adtysn.lnk
- %APPDATA%\microsoft\cwoega\ccwoega32.dll
- C:\users\rcx5439.tmp
Deletes the following files
- %APPDATA%\microsoft\cwoega\cwoega32.dll
- C:\users\inhhq.bzp.082478
Moves the following files
- from C:\users\rcx789e.tmp to C:\users\inhhq.bzp
- from C:\users\inhhq.bzp to C:\users\inhhq.bzp.082478
Substitutes the following files
- C:\users\inhhq.bzp
Deletes itself.
Network activity
Connects to
- '72.##.88.181':21
TCP
HTTP GET requests
- http://www.ip###ress.com/
- http://fo###ity.com/show-ip.php
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt
HTTP POST requests
- http://ze##ucn.org/kkBs9GYrPosH2JTm.php
- http://ze##ucn.org/saVoF4P1uSeyr4l5pylFXZPy.php
UDP
- DNS ASK ip###ress.com
- DNS ASK zo##.kiev.ua
- DNS ASK ol###.kiev.ua
- DNS ASK ze##ucn.org
- DNS ASK xu###bnz.net
- DNS ASK fo###ity.com
- DNS ASK ft#.###fashiontalks.org
- DNS ASK st#####.##gitalcertvalidation.com
Miscellaneous
Disables a certificate
Searches for the following windows
- ClassName: 'cwoega' WindowName: 'cwoega'
Creates and executes the following
- '%APPDATA%\microsoft\cwoega\cwoega.exe'
- '%APPDATA%\microsoft\cwoega\cwoega.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 10 localhost && del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 10 localhost && del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' -n 10 localhost
