Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 14f7a2d6618adb99
- <SYSTEM32>\tasks\yiueea.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl]
- [HKLM\Software\Martin Prikryl]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %APPDATA%\cgvuves
- %TEMP%\dc5e.tmp
- %TEMP%\db83.tmp
- %TEMP%\db24.tmp
- %TEMP%\d96d.tmp-shm
- %TEMP%\d96d.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\dc7e.tmp
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\577f58beff\yiueea.exe
- %TEMP%\4c7c.exe
- %TEMP%\3360.dll
- %TEMP%\2b44.exe
- %APPDATA%\bewhrcu
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %TEMP%\dc7e.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\cgvuves
- %APPDATA%\bewhrcu
Deletes the following files
- %TEMP%\d96d.tmp-shm
- %TEMP%\d96d.tmp
- %TEMP%\db24.tmp
- %TEMP%\db83.tmp
- %TEMP%\dc5e.tmp
- %TEMP%\dc7e.tmp-shm
- %TEMP%\dc7e.tmp
Deletes itself.
Network activity
Connects to
- 'on###ituyrs.org':80
- 'on###ituyrs.org':443
- 'su####lituyo.org':80
- 'sn####ukeutit.org':80
- 'li#####insteniki.org':80
- 'li####oumumy.org':80
- 'st#####luyastrelia.net':80
- '79.##7.192.18':80
- 'al###adcare.com':443
- 'mo####eyclub.org':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://79.##7.192.18/minda.exe
- http://pk#.goog/gsr1/gsr1.crt
HTTP POST requests
- http://on###ituyrs.org/
- http://su####lituyo.org/
- http://sn####ukeutit.org/
- http://li#####insteniki.org/
- http://li####oumumy.org/
- http://79.##7.192.18/9bDc8sQ/index.php
- http://st#####luyastrelia.net/
Other
- 'on###ituyrs.org':443
- 'al###adcare.com':443
- 'mo####eyclub.org':443
UDP
- DNS ASK on###ituyrs.org
- DNS ASK su####lituyo.org
- DNS ASK sn####ukeutit.org
- DNS ASK li#####insteniki.org
- DNS ASK li####oumumy.org
- DNS ASK st#####luyastrelia.net
- DNS ASK al###adcare.com
- DNS ASK mo####eyclub.org
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '%TEMP%\2b44.exe'
- '%TEMP%\4c7c.exe'
- '%TEMP%\577f58beff\yiueea.exe'
- '%TEMP%\577f58beff\yiueea.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\3360.dll
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F
- '<SYSTEM32>\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
- '<SYSTEM32>\cacls.exe' "yiueea.exe" /P "user:N"
- '<SYSTEM32>\cacls.exe' "yiueea.exe" /P "user:R" /E
- '<SYSTEM32>\cacls.exe' "..\577f58beff" /P "user:N"
- '<SYSTEM32>\cacls.exe' "..\577f58beff" /P "user:R" /E
- '<SYSTEM32>\taskeng.exe' {69CD4B48-8D1D-419F-A00C-86896FD4A547} S-1-5-21-2594934582-3011428313-3661137593-1000:zxwsxmoqs\user:Interactive:[1]
- '%WINDIR%\explorer.exe'
