Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'api-gIME' = '%APPDATA%\Microsoft\Acle3d10\d3dx0_33.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\calc.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- iexplore.exe process, urlmon.dll module
- firefox.exe process, nss3.dll module
- iexplore.exe process, mshtml.dll module
- iexplore.exe process, advapi32.dll module
- iexplore.exe process, wininet.dll module
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Internet Account Manager]
- [<HKLM>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\]
Modifies file system
Creates the following files
- %APPDATA%\microsoft\acle3d10\d3dx0_33.exe
- %TEMP%\ecae\7657.bat
- %TEMP%\20ea.bi1
- %TEMP%\17d6.bi1
Deletes the following files
- %TEMP%\20ea.bi1
- %TEMP%\17d6.bi1
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js
Deletes itself.
Network activity
Connects to
- 'x.##2.us':80
TCP
- 'ok###wa35.net':443
UDP
- DNS ASK ok###wa35.net
- DNS ASK re#####r1.opendns.com
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK my##.#pendns.com
- DNS ASK to#.##siccitycg.com
- DNS ASK x.##2.us
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
Creates and executes the following
- '%APPDATA%\Microsoft\acle3d10\d3dx0_33.exe' "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ECAE\7657.bat" "%APPDATA%\MICROS~1\Acle3d10\d3dx0_33.exe" "<Full path to file>""' (with hidden window)
- '%WINDIR%\syswow64\calc.exe' CBmWzIJQqV "%HOMEPATH%\AppData\6fdc67a7"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ECAE\7657.bat" "%APPDATA%\MICROS~1\Acle3d10\d3dx0_33.exe" "<Full path to file>""
- '%WINDIR%\syswow64\cmd.exe' /C ""%APPDATA%\MICROS~1\Acle3d10\d3dx0_33.exe" "<Full path to file>""
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\17D6.bi1"
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\20EA.bi1"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\20EA.bi1"
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\17D6.bi1"
- '%WINDIR%\syswow64\calc.exe' CBmWzIJQqV "%HOMEPATH%\AppData\6fdc67a7"
