Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\_testtraffic
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\2bdiaknm.0.cs
- %TEMP%\csc299f.tmp
- %TEMP%\1l4wb1az.out
- %TEMP%\1l4wb1az.cmdline
- %TEMP%\1l4wb1az.0.cs
- %TEMP%\iq21fxmt.dll
- %TEMP%\res18bf.tmp
- %TEMP%\csc18be.tmp
- %TEMP%\iq21fxmt.out
- %TEMP%\iq21fxmt.cmdline
- %TEMP%\iq21fxmt.0.cs
- %TEMP%\og0lmutp.dll
- %TEMP%\resb18.tmp
- %TEMP%\cscb17.tmp
- %TEMP%\og0lmutp.out
- %TEMP%\og0lmutp.cmdline
- %TEMP%\og0lmutp.0.cs
- %TEMP%\d1uaj0b2.dll
- %TEMP%\rese0ed.tmp
- %TEMP%\csce0ec.tmp
- %TEMP%\d1uaj0b2.out
- %TEMP%\d1uaj0b2.cmdline
- %TEMP%\d1uaj0b2.0.cs
- %APPDATA%\uploadslocal\windowsdatalife.exe.config
- %APPDATA%\uploadslocal\windowsdatalife.exe
- %TEMP%\2bdiaknm.dll
- %TEMP%\resad11.tmp
- %TEMP%\cscacf1.tmp
- %TEMP%\2bdiaknm.out
- %TEMP%\2bdiaknm.cmdline
- %TEMP%\res29a0.tmp
- %TEMP%\1l4wb1az.dll
Sets the 'hidden' attribute to the following files
- %APPDATA%\uploadslocal\windowsdatalife.exe
Deletes the following files
- %TEMP%\resad11.tmp
- %TEMP%\1l4wb1az.out
- %TEMP%\1l4wb1az.dll
- %TEMP%\csc299f.tmp
- %TEMP%\res29a0.tmp
- %TEMP%\iq21fxmt.cmdline
- %TEMP%\iq21fxmt.out
- %TEMP%\iq21fxmt.dll
- %TEMP%\iq21fxmt.0.cs
- %TEMP%\csc18be.tmp
- %TEMP%\res18bf.tmp
- <SYSTEM32>\tasks\_testtraffic
- %TEMP%\og0lmutp.out
- %TEMP%\og0lmutp.0.cs
- %TEMP%\1l4wb1az.cmdline
- %TEMP%\og0lmutp.cmdline
- %TEMP%\cscb17.tmp
- %TEMP%\resb18.tmp
- %TEMP%\d1uaj0b2.0.cs
- %TEMP%\d1uaj0b2.cmdline
- %TEMP%\d1uaj0b2.dll
- %TEMP%\d1uaj0b2.out
- %TEMP%\csce0ec.tmp
- %TEMP%\rese0ed.tmp
- %TEMP%\2bdiaknm.cmdline
- %TEMP%\2bdiaknm.out
- %TEMP%\2bdiaknm.0.cs
- %TEMP%\2bdiaknm.dll
- %TEMP%\cscacf1.tmp
- %TEMP%\og0lmutp.dll
- %TEMP%\1l4wb1az.0.cs
Network activity
Connects to
- 'localhost':1111
- '29###.##ient.sudorat.top':29730
TCP
Other
- '29###.##ient.sudorat.top':29730
UDP
- DNS ASK 29###.##ient.sudorat.top
Miscellaneous
Creates and executes the following
- '%APPDATA%\uploadslocal\windowsdatalife.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2bdiaknm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC9.tmp" "%TEMP%\CSCFC8.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29A0.tmp" "%TEMP%\CSC299F.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1l4wb1az.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18BF.tmp" "%TEMP%\CSC18BE.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\iq21fxmt.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ze5vnkte.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\og0lmutp.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB18.tmp" "%TEMP%\CSCB17.tmp"
- '<SYSTEM32>\taskeng.exe' {50B3BC1B-55EA-4546-B397-951711B6D7C9} S-1-5-21-3150914307-1777937420-491476919-1000:ijblynlv\user:Interactive:[1]
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD11.tmp" "%TEMP%\CSCACF1.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\d1uaj0b2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE0ED.tmp" "%TEMP%\CSCE0EC.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB18.tmp" "%TEMP%\CSCB17.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE0ED.tmp" "%TEMP%\CSCE0EC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\iq21fxmt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18BF.tmp" "%TEMP%\CSC18BE.tmp"' (with hidden window)
- '%APPDATA%\uploadslocal\windowsdatalife.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29A0.tmp" "%TEMP%\CSC299F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1l4wb1az.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\og0lmutp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2bdiaknm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ze5vnkte.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAD11.tmp" "%TEMP%\CSCACF1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\d1uaj0b2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC9.tmp" "%TEMP%\CSCFC8.tmp"' (with hidden window)
