Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /IM cog_installer.exe /f
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=Cog dir=in action=allow program="%ProgramFiles(x86)%\Cog\cog.exe" enable=yes
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\cog\coglog.txt
Network activity
TCP
- 'co#.###echpartners.net':443
UDP
- DNS ASK co#.###echpartners.net
- '<LOCALNET>.16.255':14444
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' ver
- '%WINDIR%\syswow64\fsutil.exe' volume diskfree F
- '%WINDIR%\syswow64\fsutil.exe' volume diskfree D
- '%WINDIR%\syswow64\fsutil.exe' volume diskfree C
- '%WINDIR%\syswow64\typeperf.exe' "\LogicalDisk(*:*)\Avg. Disk sec/Write" "\LogicalDisk(*:*)\Avg. Disk sec/Read" "\LogicalDisk(*:*)\Disk Reads/sec" "\LogicalDisk(*:*)\Disk Writes/sec" -sc 1
- '%WINDIR%\syswow64\cmd.exe' typeperf "\LogicalDisk(*:*)\Avg. Disk sec/Write" "\LogicalDisk(*:*)\Avg. Disk sec/Read" "\LogicalDisk(*:*)\Disk Reads/sec" "\LogicalDisk(*:*)\Disk Writes/sec" -sc 1
- '%WINDIR%\syswow64\typeperf.exe' "\Process(cog)\% Processor Time" "\Process(cog)\Working Set" "\Processor(_total)\% Processor Time" "\Memory\Available MBytes" -sc 10
- '%WINDIR%\syswow64\cmd.exe' typeperf "\Process(cog)\% Processor Time" "\Process(cog)\Working Set" "\Processor(_total)\% Processor Time" "\Memory\Available MBytes" -sc 10
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\MytechPartners\Cog /v agent_id /d 157593 /t reg_sz /f
- '%WINDIR%\syswow64\cmd.exe' reg add HKLM\Software\MytechPartners\Cog /v agent_id /d 157593 /t reg_sz /f
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_ComputerSystem Get Manufacturer Model /format:list
- '%WINDIR%\syswow64\cmd.exe' <SYSTEM32>\wbem\wmic path Win32_ComputerSystem Get Manufacturer Model /format:list
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_Bios Get SerialNumber /format:list
- '%WINDIR%\syswow64\cmd.exe' <SYSTEM32>\wbem\wmic path Win32_Bios Get SerialNumber /format:list
- '%WINDIR%\syswow64\wbem\wmic.exe' computersystem Get Name /format:list
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' <SYSTEM32>\wbem\wmic computersystem Get Name /format:list
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\MytechPartners\Cog /v checkin_interval /t REG_SZ /d 60 /f
- '%WINDIR%\syswow64\reg.exe' query HKLM\Software\MytechPartners\Cog /v checkin_interval
- '%WINDIR%\syswow64\reg.exe' query HKLM\Software\MytechPartners\Cog /v agent_id
- '%WINDIR%\syswow64\reg.exe' query HKLM\Software\MytechPartners\Cog /v customer_name
- '%WINDIR%\syswow64\cmd.exe' netsh advfirewall firewall add rule name=Cog dir=in action=allow program="%ProgramFiles(x86)%\Cog\cog.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall show rule name=Cog
- '%WINDIR%\syswow64\cmd.exe' netsh advfirewall firewall show rule name=Cog
- '%WINDIR%\syswow64\cmd.exe' taskkill /IM cog_installer.exe /f
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get Caption /format:list
- '%WINDIR%\syswow64\cmd.exe' <SYSTEM32>\wbem\wmic OS Get Caption /format:list
- '%WINDIR%\syswow64\cmd.exe' hostname
- '%WINDIR%\syswow64\hostname.exe'
