Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'f209aa73-96a2-89c4-31f2-f5ba0db1b078' = '%APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\13e70015-fe25-941c-2627-23d89dcef5631.vbs
- <SYSTEM32>\tasks\13e70015-fe25-941c-2627-23d89dcef5631
- <SYSTEM32>\tasks\13e70015-fe25-941c-2627-23d89dcef5637
- <SYSTEM32>\tasks\13e70015-fe25-941c-2627-23d89dcef563
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\content\5084-5028-<File name>.exe-01-26-10-822.dump
- %APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563t.bin
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\qnueauveearpuoltodxkpwifjxobtrosavz9315099001047112.png
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\lyxuzbdlne788768680700931410.docx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\ftcvrejhg53670081727417864.pptx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\anvcxcplqhykbbmylrteldevkdkrvq773276854289891613.aspx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\somlcorjwnuakwmaqpcgkkkhkareso102555777328496616.xls
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\dacxmriivldtqvfnaswyy240944314412681481.aspx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\qjifj455659715792990933.xlsx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\xpxhmnzxflgzi361767936861246545.docx
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\xwccmjxjseejqldod447479904260961620.keys
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\wfqxq754844910907293474.php
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\jyiykjunknauyvmhl540129171163833264.odt
- %TEMP%\sdjxzrho\sdjxzrho.0.cs
- C:\13e70015-fe25-941c-2627-23d89dcef5631\13e70015-fe25-941c-2627-23d89dcef5631.vbs
- %TEMP%\sdjxzrho\sdjxzrho.cmdline
- %TEMP%\sdjxzrho\sdjxzrho.out
- %TEMP%\sdjxzrho\cscbadf8975b1774e81bfff3940fa33de6c.tmp
- %TEMP%\res6b1e.tmp
- %TEMP%\sdjxzrho\sdjxzrho.dll
- %TEMP%\content\1076-3844-regasm.exe-01-26-31-406.dump
- %APPDATA%\d512f03c-2675-a593-5c94-5f1b33d1b001\d512f03c-2675-a593-5c94-5f1b33d1b001
- %TEMP%\content\1076-3844-regasm.exe-01-26-31-602.dump
- %TEMP%\13e70015-fe25-941c-2627-23d89dcef563\poiadqfbxedswlhalmfkofdafulswhvxuixnzgwow193683472454854520436066796.ico
- %APPDATA%\d512f03c-2675-a593-5c94-5f1b33d1b001\winring0x64.sys
Network activity
Connects to
- 'bi###cket.org':443
- 'ip##pi.com':80
- '10#.#89.13.48':80
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- 'bi###cket.org':443
UDP
- DNS ASK my######ain394863467.com
- DNS ASK bi###cket.org
- DNS ASK ip##pi.com
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe'
- '<SYSTEM32>\cmd.exe' /C schtasks /delete /f /tn 13e70015-fe25-941c-2627-23d89dcef5631
- '<SYSTEM32>\cmd.exe' /C schtasks /create /f /sc daily /st 12:00 /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef5631 /tr C:\13e70015-fe25-941c-2627-23d89dcef5631\13e70015-fe25-941c-2627-23d89dcef5631.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' /C $settingsSet = New-ScheduledTaskSettingsSet -Hidden -DontStopIfGoingOnBatteries -AllowStartIfOnBatteries -Priority 0 -StartWhenAvailable -DisallowHardTerminate;$settingsSet.ExecutionTimeLimi...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sdjxzrho\sdjxzrho.cmdline"
- '<SYSTEM32>\schtasks.exe' /delete /f /tn 13e70015-fe25-941c-2627-23d89dcef5631
- '<SYSTEM32>\schtasks.exe' /create /f /sc daily /st 12:00 /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef5631 /tr C:\13e70015-fe25-941c-2627-23d89dcef5631\13e70015-fe25-941c-2627-23d89dcef5631.vbs
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:%TEMP%\RES6B1E.tmp" "%TEMP%\sdjxzrho\CSCBADF8975B1774E81BFFF3940FA33DE6C.TMP"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' /C net start 'Schedule'
- '<SYSTEM32>\cmd.exe' /C schtasks /delete /f /tn 13e70015-fe25-941c-2627-23d89dcef5637
- '<SYSTEM32>\cmd.exe' /C schtasks /create /f /sc daily /st 03:00 /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef5637 /tr "\"%APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563.exe\"...
- '<SYSTEM32>\cmd.exe' /C schtasks /create /f /sc onlogon /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef563 /tr "\"%APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563.exe\" 13e70015...
- '<SYSTEM32>\schtasks.exe' /delete /f /tn 13e70015-fe25-941c-2627-23d89dcef5637
- '<SYSTEM32>\schtasks.exe' /create /f /sc daily /st 03:00 /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef5637 /tr "\"%APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563.exe\" 13e70015-fe...
- '<SYSTEM32>\net.exe' start Schedule
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn 13e70015-fe25-941c-2627-23d89dcef563 /tr "\"%APPDATA%\13e70015-fe25-941c-2627-23d89dcef563\13e70015-fe25-941c-2627-23d89dcef563.exe\" 13e70015-fe25-941c-2...
- '<SYSTEM32>\net1.exe' start Schedule
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sdjxzrho\sdjxzrho.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:%TEMP%\RES6B1E.tmp" "%TEMP%\sdjxzrho\CSCBADF8975B1774E81BFFF3940FA33DE6C.TMP"' (with hidden window)
