Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\UpdateEngine] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\UpdateEngine] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\cMXWMlp" && start "" "C:\Drivers\cMXWMlp\NWo6RQj3.exe"'
Creates the following services
- 'UpdateEngine' cmd /c cd /d "C:\Drivers\cMXWMlp" && start "" "C:\Drivers\cMXWMlp\NWo6RQj3.exe"
Malicious functions
Launches a large number of processes
Patches code
in dll
- nwo6rqj3.exe process, AEPIC.dll module
- nwo6rqj3.exe process, apphelp.dll module
in AMSI dll
- nwo6rqj3.exe process, Amsi.dll module
in NTDLL dll
- nwo6rqj3.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\is-bms1i.tmp\<File name>.tmp
- %TEMP%\is-fdsmk.tmp\_isetup\_setup64.tmp
- C:\drivers\cmxwmlp\is-7768a.tmp
- C:\drivers\cmxwmlp\is-9bt5v.tmp
- C:\drivers\cmxwmlp\is-cfrkj.tmp
- C:\drivers\cmxwmlp\is-03n0v.tmp
- C:\drivers\cmxwmlp\is-ginev.tmp
- C:\drivers\cmxwmlp\is-mgn68.tmp
- C:\drivers\cmxwmlp\is-ouhh0.tmp
- C:\drivers\cmxwmlp\is-ip7ls.tmp
- C:\drivers\kizjeiil\is-e1qqg.tmp
Deletes following files that it created itself
- %TEMP%\is-fdsmk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-bms1i.tmp\<File name>.tmp
Moves the following files
- from C:\drivers\cmxwmlp\is-7768a.tmp to C:\drivers\cmxwmlp\6v5haixrqhc.idiq
- from C:\drivers\cmxwmlp\is-9bt5v.tmp to C:\drivers\cmxwmlp\9x2xv41wture.ixqk
- from C:\drivers\cmxwmlp\is-cfrkj.tmp to C:\drivers\cmxwmlp\ffpde.tpda
- from C:\drivers\cmxwmlp\is-03n0v.tmp to C:\drivers\cmxwmlp\libfilezilla-58.dll
- from C:\drivers\cmxwmlp\is-ginev.tmp to C:\drivers\cmxwmlp\libgcc_s_seh-1.dll
- from C:\drivers\cmxwmlp\is-mgn68.tmp to C:\drivers\cmxwmlp\libstdc++-6.dll
- from C:\drivers\cmxwmlp\is-ouhh0.tmp to C:\drivers\cmxwmlp\nwo6rqj3.exe
- from C:\drivers\cmxwmlp\is-ip7ls.tmp to C:\drivers\cmxwmlp\yfb.ovxd
- from C:\drivers\kizjeiil\is-e1qqg.tmp to C:\drivers\kizjeiil\123.png
Miscellaneous
Creates and executes the following
- '%TEMP%\is-bms1i.tmp\<File name>.tmp' /SL5="$D01E2,14313700,832512,<Full path to file>"
- 'C:\drivers\cmxwmlp\nwo6rqj3.exe'
Executes the following
- '<SYSTEM32>\sc.exe' create UpdateEngine binPath= "cmd /c cd /d \"C:\Drivers\cMXWMlp\" && start \"\" \"C:\Drivers\cMXWMlp\NWo6RQj3.exe\"" start= auto
- '<SYSTEM32>\sc.exe' failure UpdateEngine reset= 0 actions= restart/1000
- '<SYSTEM32>\sc.exe' start UpdateEngine
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Drivers\cMXWMlp" && start "" "C:\Drivers\cMXWMlp\NWo6RQj3.exe"
- '<SYSTEM32>\sc.exe' start VSS
- '<SYSTEM32>\sc.exe' create UpdateEngine binPath= "cmd /c cd /d \"C:\Drivers\cMXWMlp\" && start \"\" \"C:\Drivers\cMXWMlp\NWo6RQj3.exe\"" start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' failure UpdateEngine reset= 0 actions= restart/1000' (with hidden window)
- '<SYSTEM32>\sc.exe' start UpdateEngine' (with hidden window)
- '<SYSTEM32>\sc.exe' start VSS' (with hidden window)
