Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\wmiApSrv] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\a1DKBtg1aM] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\a1DKBtg1aM] 'ImagePath' = 'cmd /c cd /d "%ProgramFiles(x86)%\steesp\hvnqeere\" && start "" "%ProgramFiles(x86)%\steesp\hvnqeere\a1DKBtg1aM.exe"'
Creates the following services
- 'a1DKBtg1aM' cmd /c cd /d "%ProgramFiles(x86)%\steesp\hvnqeere\" && start "" "%ProgramFiles(x86)%\steesp\hvnqeere\a1DKBtg1aM.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force
Modifies file system
Creates the following files
- %TEMP%\is-6qmog.tmp\<File name>.tmp
- %TEMP%\is-jtv3t.tmp\_isetup\_regdll.tmp
- %TEMP%\is-jtv3t.tmp\_isetup\_setup64.tmp
- %TEMP%\is-jtv3t.tmp\_isetup\_shfoldr.dll
- C:\users\public\<File name>.exe
- %ProgramFiles(x86)%\steesp\hvnqeere\is-q11go.tmp
- %ProgramFiles(x86)%\steesp\hvnqeere\is-a2he5.tmp
- %ProgramFiles(x86)%\steesp\hvnqeere\is-79sjg.tmp
- %ProgramFiles(x86)%\steesp\hvnqeere\iwfdsso
- <SYSTEM32>\uipoqtu
- %WINDIR%\ykukjxj.bat
- nul
- %WINDIR%\temp\__psscriptpolicytest_yzior2he.3r0.ps1
- %WINDIR%\temp\__psscriptpolicytest_cqimatoj.kry.psm1
- <SYSTEM32>\dzdcewn
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-12-539.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-12-931.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-13-142.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-13-442.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-13-600.dump
- %WINDIR%\temp\__psscriptpolicytest_cwglcrtv.fni.ps1
- %WINDIR%\temp\__psscriptpolicytest_wiurcq0v.use.psm1
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-14-286.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-14-373.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-14-480.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-14-656.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-049.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-384.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-663.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-743.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-797.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-862.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-918.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-15-972.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-16-090.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-002.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-135.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-189.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-204.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-267.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-321.dump
- %WINDIR%\temp\content\1648-2572-powershell.exe-21-17-18-437.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
Deletes following files that it created itself
- %TEMP%\is-jtv3t.tmp\_isetup\_regdll.tmp
- %TEMP%\is-jtv3t.tmp\_isetup\_setup64.tmp
- %TEMP%\is-jtv3t.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6qmog.tmp\<File name>.tmp
- %WINDIR%\temp\__psscriptpolicytest_yzior2he.3r0.ps1
- %WINDIR%\temp\__psscriptpolicytest_cqimatoj.kry.psm1
- %WINDIR%\temp\__psscriptpolicytest_cwglcrtv.fni.ps1
- %WINDIR%\temp\__psscriptpolicytest_wiurcq0v.use.psm1
Moves the following files
- from %ProgramFiles(x86)%\steesp\hvnqeere\is-q11go.tmp to %ProgramFiles(x86)%\steesp\hvnqeere\b95v5a.s
- from %ProgramFiles(x86)%\steesp\hvnqeere\is-a2he5.tmp to %ProgramFiles(x86)%\steesp\hvnqeere\pkrv.ts
- from %ProgramFiles(x86)%\steesp\hvnqeere\is-79sjg.tmp to %ProgramFiles(x86)%\steesp\hvnqeere\a1dkbtg1am.exe
Network activity
Connects to
- '45.##2.138.133':6268
TCP
Other
- '45.##2.138.133':6268
Miscellaneous
Searches for the following windows
- ClassName: 'Q360SafeMonClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-6qmog.tmp\<File name>.tmp' /SL5="$C01F2,7649265,74752,<Full path to file>"
- '%ProgramFiles(x86)%\steesp\hvnqeere\a1dkbtg1am.exe'
Executes the following
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '<SYSTEM32>\cmd.exe' /c "%WINDIR%\YkUkJXj.bat"
- '<SYSTEM32>\systemsettingsbroker.exe'
- '<SYSTEM32>\tasklist.exe' /fi "PID eq 4236"
- '<SYSTEM32>\findstr.exe' /i "4236"
- '<SYSTEM32>\timeout.exe' /t 15
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force' (with hidden window)
