Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\s-3-2-25-1182241747-1400514201-1385634041-5322\{fpzqsxs9-833d-sbo4-6u2a-58kv1dqhqvxv}
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\WinRing0x64.sy...
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\WinRing0x64.sys
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\es9v18vw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\bsqjuktf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qtnf4inz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0988nfyh\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\config.json
- %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\kbdkni.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\nlsdata0009.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\es9v18vw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\bsqjuktf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qtnf4inz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0988nfyh\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\config.json
- %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\kbdkni.exe
Moves itself
- from <Full path to file> to %APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\nlsdata0009.exe
Network activity
Connects to
- 'ip###ger.org':443
- 'ya####ba.zzz.com.ua':21
- 'ya####ba.zzz.com.ua':55554
- 'ya####ba.zzz.com.ua':57298
- 'xm#####.nanopool.org':14444
TCP
Other
- 'ip###ger.org':443
- 'ya####ba.zzz.com.ua':21
- 'xm#####.nanopool.org':14444
UDP
- DNS ASK ip###ger.org
- DNS ASK ya####ba.zzz.com.ua
- DNS ASK xm#####.nanopool.org
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\kbdkni.exe'
- '%APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\nlsdata0009.exe' ' (with hidden window)
- '%APPDATA%\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.3.9600.16384_cs-cz_3c3fa766a48d21bc\kbdkni.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\taskeng.exe' {EEC5659D-4071-47C0-9604-B827566B7D6D} S-1-5-21-1960123792-2022915161-3775307078-1001:xuaviijwo\user:Interactive:[1]
