Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\tempo runner voei3qi.job
- <SYSTEM32>\tasks\tempo runner voei3qi
- %WINDIR%\tasks\tempo runner voeidqi.job
- <SYSTEM32>\tasks\tempo runner voeidqi
- %WINDIR%\tasks\tempo runner voei6qi.job
- <SYSTEM32>\tasks\tempo runner voei6qi
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\giskouo] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\giskouo] 'ImagePath' = '"%ALLUSERSPROFILE%\QongaMiwe\voeiaqi.exe" /ts2=1'
Creates the following services
- 'giskouo' %ALLUSERSPROFILE%\QongaMiwe oeiaqi.exe" /ts2=
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\nspd51a.tmp
- %TEMP%\nspd53a.tmp\system.dll
- %TEMP%\nspd53a.tmp\stdutils.dll
- %TEMP%\nspd53a.tmp\tmp.bpu
- %TEMP%\nspd53a.tmp\apuifwad.dll
- %TEMP%\nspd53a.tmp\nsislog.dll
- %TEMP%\adblocker_installer__1751325382.txt
- %TEMP%\nspd53a.tmp\nsisos.dll
- %TEMP%\nspd53a.tmp\userinfo.dll
- %ALLUSERSPROFILE%\qongamiwe\utils.exe
- %ALLUSERSPROFILE%\qongamiwe\dahfogpesch.dat
- %ALLUSERSPROFILE%\qongamiwe\dahfogpeschb.dat
- %ALLUSERSPROFILE%\qongamiwe\logo.ico
- %ALLUSERSPROFILE%\qongamiwe\voei3qi.exe
- %ALLUSERSPROFILE%\qongamiwe\voei6qi.exe
- %ALLUSERSPROFILE%\qongamiwe\voei6qi.dll
- %ALLUSERSPROFILE%\qongamiwe\voei3qi.dll
- %ALLUSERSPROFILE%\qongamiwe\voei6qid.dll
- %ALLUSERSPROFILE%\qongamiwe\voei3qid.dll
- %ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe
- %ALLUSERSPROFILE%\qongamiwe\voeiadqi.bnp
- %ALLUSERSPROFILE%\qongamiwe\voeidqi.exe
- %ALLUSERSPROFILE%\qongamiwe\voeiwqi.exe
- %ALLUSERSPROFILE%\qongamiwe\voeiwdqi.bnp
- %ALLUSERSPROFILE%\qongamiwe\uninstaller.exe
- %ALLUSERSPROFILE%\qongamiwe\content\jquery4toolbar.js
- %ALLUSERSPROFILE%\qongamiwe\content\mugwalzoid.js
- %ALLUSERSPROFILE%\qongamiwe\content\qourqe.js
- %ALLUSERSPROFILE%\qongamiwe\content\ykolonhpu.js
- %LOCALAPPDATA%low\zecogonmik\content\jquery4toolbar.js
- %LOCALAPPDATA%low\zecogonmik\content\mugwalzoid.js
- %LOCALAPPDATA%low\zecogonmik\content\qourqe.js
- %LOCALAPPDATA%low\zecogonmik\content\ykolonhpu.js
- %LOCALAPPDATA%low\zecogonmik\content\trayicons\logo.ico
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
Deletes the following files
- %TEMP%\nspd53a.tmp\apuifwad.dll
- %TEMP%\nspd53a.tmp\nsislog.dll
- %TEMP%\nspd53a.tmp\nsisos.dll
- %TEMP%\nspd53a.tmp\stdutils.dll
- %TEMP%\nspd53a.tmp\system.dll
- %TEMP%\nspd53a.tmp\tmp.bpu
- %TEMP%\nspd53a.tmp\userinfo.dll
- %WINDIR%\tasks\tempo runner voei3qi.job
- <SYSTEM32>\tasks\tempo runner voei3qi
- %WINDIR%\tasks\tempo runner voeidqi.job
- <SYSTEM32>\tasks\tempo runner voeidqi
- %WINDIR%\tasks\tempo runner voei6qi.job
- <SYSTEM32>\tasks\tempo runner voei6qi
Moves the following files
- from %ALLUSERSPROFILE%\qongamiwe\voeidqi.exe to %ALLUSERSPROFILE%\qongamiwe\voeidqi.exe
- from %ALLUSERSPROFILE%\qongamiwe\voei3qi.exe to %ALLUSERSPROFILE%\qongamiwe\voei3qi.exe
- from %ALLUSERSPROFILE%\qongamiwe\voei6qi.exe to %ALLUSERSPROFILE%\qongamiwe\voei6qi.exe
- from %LOCALAPPDATA%low\zecogonmik\content\qourqe.js to %LOCALAPPDATA%low\zecogonmik\content\qourqe.js
Network activity
Connects to
- 'cd#.##stries.com':80
TCP
HTTP POST requests
- http://cd#.##stries.com/wrp/ri
UDP
- DNS ASK cd#.##stries.com
- DNS ASK s3.##wss.info
- DNS ASK s1#####15.xcodelib.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'laajpirkosea' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /Firstime=1
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /ts2=1
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voei3qi.exe"
- '%ALLUSERSPROFILE%\qongamiwe\voei3qi.exe'
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voeidqi.exe"
- '%ALLUSERSPROFILE%\qongamiwe\voeidqi.exe'
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voei6qi.exe"
- '%ALLUSERSPROFILE%\qongamiwe\voei6qi.exe'
Executes the following
- '<SYSTEM32>\taskeng.exe' {FCCEC752-E533-4142-AB96-F5D1E1D29F10} S-1-5-21-3691498038-2086406363-2140527554-1000:ndecijaxkxb\user:Interactive:[1]
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voei3qi.exe"' (with hidden window)
- '%ALLUSERSPROFILE%\qongamiwe\voei3qi.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voeidqi.exe"' (with hidden window)
- '%ALLUSERSPROFILE%\qongamiwe\voeidqi.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\qongamiwe\voeiaqi.exe' /dgad="%ALLUSERSPROFILE%\QongaMiwe\voei6qi.exe"' (with hidden window)
- '%ALLUSERSPROFILE%\qongamiwe\voei6qi.exe' ' (with hidden window)
