Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc32
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\tasks\dialersvc32.job
- %WINDIR%\tasks\dialersvc64.job
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\sc.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\choice.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %TEMP%\tmp365e.tmp
- %TEMP%\tmp365f.tmp
- %TEMP%\tmp3670.tmp
- %TEMP%\tmp3680.tmp
- %TEMP%\tmp3691.tmp
- %TEMP%\tmp3692.tmp
- %TEMP%\tmp36a2.tmp
- %TEMP%\tmp36a3.tmp
- %TEMP%\tmp36b4.tmp
- %TEMP%\tmp36b5.tmp
- %TEMP%\tmp36b6.tmp
- %TEMP%\tmp36c7.tmp
- %TEMP%\tmp36c8.tmp
- %TEMP%\tmp36c9.tmp
- %TEMP%\tmp37a4.tmp
- %TEMP%\tmp37b5.tmp
- %TEMP%\tmp3ae1.tmp
- %TEMP%\tmp8373.tmp
- %TEMP%\tmp8353.tmp
- %TEMP%\tmp8313.tmp
- %TEMP%\tmp82f3.tmp
- %TEMP%\tmp82e3.tmp
- %TEMP%\tmp82c2.tmp
- %TEMP%\tmp7401.tmp
- %TEMP%\tmp7412.tmp
- %TEMP%\tmp5cf7.tmp
- %TEMP%\tmp5ce7.tmp
- %TEMP%\tmp5cd6.tmp
- %TEMP%\tmp5cc5.tmp
- %TEMP%\tmp5cb5.tmp
- %TEMP%\tmp3af1.tmp
- %TEMP%\tmp8374.tmp
- %TEMP%\tmp364d.tmp
- %TEMP%\tmp363d.tmp
- %TEMP%\tmp362c.tmp
- %TEMP%\explorer.exe
- %TEMP%\tmp3275.tmp
- %TEMP%\tmp3285.tmp
- %TEMP%\tmp32b5.tmp
- %TEMP%\tmp32b6.tmp
- %TEMP%\tmp32c7.tmp
- %TEMP%\tmp32c8.tmp
- %TEMP%\tmp32e8.tmp
- %TEMP%\tmp32e9.tmp
- %TEMP%\tmp32fa.tmp
- %TEMP%\tmp330a.tmp
- %TEMP%\tmp330b.tmp
- %TEMP%\tmp331c.tmp
- %TEMP%\tmp332c.tmp
- %TEMP%\tmp332d.tmp
- %TEMP%\tmp333e.tmp
- %TEMP%\tmp334f.tmp
- %TEMP%\tmp361b.tmp
- %TEMP%\tmp360a.tmp
- %TEMP%\tmp35ab.tmp
- %TEMP%\tmp359b.tmp
- %TEMP%\tmp3443.tmp
- %TEMP%\tmp3432.tmp
- %TEMP%\tmp33e2.tmp
- %TEMP%\tmp33f3.tmp
- %TEMP%\tmp33d1.tmp
- %TEMP%\tmp33d0.tmp
- %TEMP%\tmp33c0.tmp
- %TEMP%\tmp33bf.tmp
- %TEMP%\tmp338f.tmp
- %TEMP%\tmp338e.tmp
- %TEMP%\tmp362b.tmp
- %TEMP%\tmp8394.tmp
Deletes the following files
- %TEMP%\tmp3285.tmp
- %TEMP%\tmp3670.tmp
- %TEMP%\tmp3692.tmp
- %TEMP%\tmp3691.tmp
- %TEMP%\tmp36a3.tmp
- %TEMP%\tmp36a2.tmp
- %TEMP%\tmp36b5.tmp
- %TEMP%\tmp36b4.tmp
- %TEMP%\tmp36c7.tmp
- %TEMP%\tmp36b6.tmp
- %TEMP%\tmp36c9.tmp
- %TEMP%\tmp36c8.tmp
- %TEMP%\tmp37b5.tmp
- %TEMP%\tmp37a4.tmp
- %TEMP%\tmp365e.tmp
- %TEMP%\tmp3680.tmp
- %TEMP%\tmp3af1.tmp
- %TEMP%\tmp3ae1.tmp
- %TEMP%\tmp8373.tmp
- %TEMP%\tmp8353.tmp
- %TEMP%\tmp8313.tmp
- %TEMP%\tmp82f3.tmp
- %TEMP%\tmp82e3.tmp
- %TEMP%\tmp3443.tmp
- %TEMP%\tmp82c2.tmp
- %TEMP%\tmp7401.tmp
- %TEMP%\tmp5cf7.tmp
- %TEMP%\tmp5ce7.tmp
- %TEMP%\tmp5cd6.tmp
- %TEMP%\tmp5cc5.tmp
- %TEMP%\tmp5cb5.tmp
- %TEMP%\svchost.exe
- %TEMP%\tmp365f.tmp
- %TEMP%\tmp363d.tmp
- %TEMP%\tmp364d.tmp
- %TEMP%\tmp32b6.tmp
- %TEMP%\tmp32b5.tmp
- %TEMP%\tmp32c8.tmp
- %TEMP%\tmp32c7.tmp
- %TEMP%\tmp32e9.tmp
- %TEMP%\tmp32e8.tmp
- %TEMP%\tmp330a.tmp
- %TEMP%\tmp32fa.tmp
- %TEMP%\tmp331c.tmp
- %TEMP%\tmp330b.tmp
- %TEMP%\tmp332d.tmp
- %TEMP%\tmp332c.tmp
- %TEMP%\tmp334f.tmp
- %TEMP%\tmp333e.tmp
- %TEMP%\tmp3275.tmp
- %TEMP%\tmp338f.tmp
- %TEMP%\tmp362b.tmp
- %TEMP%\tmp338e.tmp
- %TEMP%\tmp33c0.tmp
- %TEMP%\tmp33bf.tmp
- %TEMP%\tmp33d1.tmp
- %TEMP%\tmp33d0.tmp
- %TEMP%\tmp33f3.tmp
- %TEMP%\tmp7412.tmp
- %TEMP%\tmp33e2.tmp
- %TEMP%\tmp8374.tmp
- %TEMP%\tmp35ab.tmp
- %TEMP%\tmp359b.tmp
- %TEMP%\tmp361b.tmp
- %TEMP%\tmp360a.tmp
- %TEMP%\tmp362c.tmp
- %TEMP%\tmp3432.tmp
- %TEMP%\tmp8394.tmp
Network activity
Connects to
- '16#.#5.169.73':49194
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://16#.##.169.73:49194/ via 16#.#5.169.73
Other
- 'ap#.ip.sb':443
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%TEMP%\explorer.exe'
- '%APPDATA%\chrome\updater.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please dis...
- '<SYSTEM32>\sc.exe' failure UsoSvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' failure dosvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' failure bits reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' failure wuauserv reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\takeown.exe' /f C:\\Windows\\System32\\WaaSMedicSvc.dll
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGQAdgBpAGUAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBuAGgAdQBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkA...
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\dllhost.exe' /Processid:{14c7d6c7-73a1-4009-83fd-086ee4b3f998}
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus...
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\explorer.exe
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\svchost.exe
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreferenc...
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\icacls.exe' C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
