Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\neierim] 'ImagePath' = '<SYSTEM32>\WfgUllV.sys'
- [<HKLM>\System\CurrentControlSet\Services\ofjfsjs] 'ImagePath' = '<SYSTEM32>\zvkLXnx.sys'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\upnpcont.exe
- %WINDIR%\explorer.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %APPDATA%\tencent\qq\wxgg.tmp
- %APPDATA%\tencent\qq\config.ini
- %APPDATA%\luprsm\sm7pln.tmp
- %APPDATA%\luprsm\tqnomre.exe
- <SYSTEM32>\xocw.exe
- %APPDATA%\luprsm\unhk.tmp
- %APPDATA%\luprsm\unhk64.tmp
- <SYSTEM32>\wfgullv.sys
- %WINDIR%\temp\bbimage.manifest
- %WINDIR%\temp\udddda0.tmp
- <SYSTEM32>\zvklxnx.sys
- <SYSTEM32>\xvvxhab.dll
- <SYSTEM32>\subdb\cert.db
- <SYSTEM32>\subdb\trust ca
- xvvxhab
- %APPDATA%\tencent\qq\asny.tmp
- %APPDATA%\luprsm\fuulsc.xml
- %APPDATA%\luprsm\udtmbhold.exe
- %APPDATA%\luprsm\rfzeurold.exe
- %TEMP%\~pidtemp.tmp
- %TEMP%\~myconf.tmp.tmp
- %TEMP%\connect.exe
- %TEMP%\76mce.exe
- %LOCALAPPDATA%\scccon.ini
- <SYSTEM32>\vmqmzqi.txt
- %TEMP%\maov.tmp
- %TEMP%\svchstold.exe
- %TEMP%\dmnview.exe
- %WINDIR%\libwqddr\dmnview.exe
- %TEMP%\ten\vnspdvq.dll
- %TEMP%\ten\vnspdvqrs.tmp
- %WINDIR%\run.bat
- %APPDATA%\luprsm\vkctbkold.exe
- %APPDATA%\luprsm\vkctbk.exe
- %APPDATA%\luprsm\rfzeur.exe
- %ProgramFiles(x86)%\pidgin\ca-certs\trust ca.pem
Deletes the following files
- %TEMP%\~pidtemp.tmp
- %TEMP%\svchstold.exe
- %TEMP%\dmnview.exe
- %TEMP%\maov.tmp
- %TEMP%\76mce.exe
- %TEMP%\ten\vnspdvq.dll
- %APPDATA%\luprsm\vkctbkold.exe
- %APPDATA%\luprsm\rfzeurold.exe
- %APPDATA%\luprsm\sm7pln.tmp
- %WINDIR%\temp\udddda0.tmp
- <SYSTEM32>\wfgullv.sys
- <SYSTEM32>\zvklxnx.sys
Moves the following files
- from %TEMP%\svchost.exe to %TEMP%\....\1074734
- from %TEMP%\connect.exe to %TEMP%\....\1088375
- from %WINDIR%\libwqddr\dmnview.exe to %WINDIR%\libwqddr\dmnview--.exe
- from %APPDATA%\luprsm\udtmbhold.exe to %APPDATA%\luprsm\udtmbh.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ps.###edia.cn:4199/p2p_v4/psp.php?md################################## via ps.##media.cn
- http://p2.##media.cn/p2p_v4/data/home/HOME20191123.HOME
- http://ap#.c7.gg/api.php?fo#######################################################################################
- http://lo#.#oomeng.com/home/?us###########################################################
UDP
- DNS ASK ps.##media.cn
- DNS ASK p2.##media.cn
- DNS ASK ap#.c7.gg
- DNS ASK lo#.#oomeng.com
- '255.255.255.255':49861
- '<LOCALNET>.89.11':62741
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '' WindowName: 'MsgDebugView'
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\svchost.exe' -k RPC
- '%TEMP%\connect.exe'
- '%TEMP%\76mce.exe' /plat:CMD /npep /s66 /aliasno /HOME:https://www.23##.com/?90#########
- '%WINDIR%\libwqddr\dmnview.exe'
- '%APPDATA%\luprsm\vkctbk.exe'
- '%WINDIR%\libwqddr\dmnview.exe' ' (with hidden window)
- '<SYSTEM32>\upnpcont.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\run.bat' (with hidden window)
- '%APPDATA%\luprsm\vkctbk.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\svchost.exe"
- '<SYSTEM32>\upnpcont.exe'
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\run.bat
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\upnpcont.exe"
- '<SYSTEM32>\cmd.exe' /c dir "%HOMEPATH%\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B
- '<SYSTEM32>\cmd.exe' /c dir "%LOCALAPPDATA%\Mozilla\Firefox\Profiles\*.default" /B
