Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Host-process' = '"D:\WindowsData\hostdl.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft localmanager
- <SYSTEM32>\tasks\updateservice
Malicious functions
Injects code into
the following user processes:
- nfra4c.exe
- hostdl.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %ProgramFiles(x86)%\owlfr\owlfr\yt-c.exe
- %ProgramFiles(x86)%\owlfr\owlfr\nfra4c.exe
- %ProgramFiles(x86)%\owlfr\owlfr\neutentg.exe
- %ProgramFiles(x86)%\yt-conv\newtonsoft.json.dll
- %ProgramFiles(x86)%\yt-conv\newtonsoft.json.xml
- %ProgramFiles(x86)%\yt-conv\youtube mp4 converter.exe
- %ProgramFiles(x86)%\yt-conv\youtubeicon.ico
- %ProgramFiles(x86)%\yt-conv\uninstall.exe
- %HOMEPATH%\desktop\yt-conv.lnk
- %ProgramFiles(x86)%\yt-conv\uninstall.ini
- %ALLUSERSPROFILE%\microsoft services\lsm.exe
- %LOCALAPPDATA%\youtube_mp4_converter\youtube_mp4_converter.exe_url_rjcy01nm41g2khmetz1cqcf15etmjnlr\1.0.0.0\nwwp2hi1.newcfg
- %APPDATA%\history
- D:\windowsdata\hostdl.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft services\lsm.exe
- %APPDATA%\history
- D:\windowsdata\hostdl.exe
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Moves the following files
- from %LOCALAPPDATA%\youtube_mp4_converter\youtube_mp4_converter.exe_url_rjcy01nm41g2khmetz1cqcf15etmjnlr\1.0.0.0\nwwp2hi1.newcfg to %LOCALAPPDATA%\youtube_mp4_converter\youtube_mp4_converter.exe_url_rjcy01nm41g2khmetz1cqcf15etmjnlr\1.0.0.0\user.config
Substitutes the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Network activity
Connects to
- 'ip###ger.com':80
- 'ip###ger.com':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
TCP
Other
- 'ip###ger.com':443
UDP
- DNS ASK ip###ger.com
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\owlfr\owlfr\yt-c.exe'
- '%ProgramFiles(x86)%\owlfr\owlfr\nfra4c.exe'
- '%ProgramFiles(x86)%\owlfr\owlfr\neutentg.exe'
- '%ProgramFiles(x86)%\yt-conv\youtube mp4 converter.exe'
- 'D:\windowsdata\hostdl.exe' "%ProgramFiles(x86)%\OwlFr\OwlFr\nfra4c.exe"
- 'D:\windowsdata\hostdl.exe'
- '%ALLUSERSPROFILE%\microsoft services\lsm.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC MINUTE /TN "Microsoft LocalManager" /TR \""%ALLUSERSPROFILE%\Microsoft Services\lsm.exe\""
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /TN "Microsoft LocalManager" /TR \""%ALLUSERSPROFILE%\Microsoft Services\lsm.exe\""
- '%WINDIR%\syswow64\schtasks.exe' /create /tn UpdateService /tr "D:\WindowsData\hostdl.exe" /sc minute /F
- '<SYSTEM32>\taskeng.exe' {7A6631A0-58C5-4E49-B622-2549B7F5E9F0} S-1-5-21-3691498038-2086406363-2140527554-1000:xxqppfjl\user:Interactive:[1]
- '%ProgramFiles(x86)%\owlfr\owlfr\yt-c.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC MINUTE /TN "Microsoft LocalManager" /TR \""%ALLUSERSPROFILE%\Microsoft Services\lsm.exe\""' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn UpdateService /tr "D:\WindowsData\hostdl.exe" /sc minute /F' (with hidden window)
- 'D:\windowsdata\hostdl.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft services\lsm.exe' ' (with hidden window)
