Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\Currentversion\Run] 'cynoe.exe' = '%APPDATA%\Qoys\cynoe.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveSync' = '%TEMP%\svchlp3.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSvc' = '%APPDATA%\diaghubqzw.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security checks
Malicious functions
Creates and executes the following
- '<Full path to file>' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\sihost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\helppane.exe
the following user processes:
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Patches code
in dll
- geydg.exe process, KERNEL32.dll module
- geydg.exe process, KERNELBASE.dll module
- geydg.exe process, ADVAPI32.dll module
- geydg.exe process, USER32.dll module
in AMSI dll
- svchlp1.exe process, Amsi.dll module
- 6f9c4e93ec1c4b90baab.exe process, Amsi.dll module
in NTDLL dll
- svchlp1.exe process, ntdll.dll module
- 6f9c4e93ec1c4b90baab.exe process, ntdll.dll module
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A02' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A03' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A06' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\svchlp1.exe
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %TEMP%\svchlp2.exe
- %APPDATA%\qoys\cynoe.exe
- %TEMP%\tmp1bfd87af.bat
- %TEMP%\svchlp3.exe
- %TEMP%\bbvejpbl.exe
- %TEMP%\svchlp4.exe
- %APPDATA%\diaghubqzw.exe
- %TEMP%\wzgqrz0q.exe
- %TEMP%\tmp757fa4c3.bat
- %TEMP%\svchlp5.exe
- %TEMP%\e5ww9mhe.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %APPDATA%\qoys\cynoe.exe
- %TEMP%\bbvejpbl.exe
- %APPDATA%\diaghubqzw.exe
- %TEMP%\wzgqrz0q.exe
- %TEMP%\e5ww9mhe.exe
Modifies the following files
Network activity
Connects to
- '19#.#51.107.186':80
- '19#.#62.199.186':80
- 'google.com':80
- 'google.com':443
TCP
HTTP GET requests
- http://19#.#51.107.186/3.exe
- http://19#.#62.199.186/stlr.exe
- http://www.google.com/webhp
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf##############
- http://19#.#62.199.186/2.exe
HTTP POST requests
- http://19#.#51.107.186/zs/gate.php
Other
- 'google.com':443
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'MozillaWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\svchlp1.exe'
- '%TEMP%\svchlp2.exe'
- '%APPDATA%\qoys\cynoe.exe'
- '%TEMP%\svchlp3.exe'
- '%TEMP%\svchlp4.exe'
- '%TEMP%\bbvejpbl.exe'
- '%TEMP%\wzgqrz0q.exe'
- '%TEMP%\svchlp5.exe'
- '%TEMP%\e5ww9mhe.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\tmp1bfd87af.bat"
- '%WINDIR%\helppane.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\tmp757fa4c3.bat"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-sandbox
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\"
- '%TEMP%\svchlp1.exe' ' (with hidden window)
- '%TEMP%\svchlp2.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\tmp1bfd87af.bat"' (with hidden window)
- '%TEMP%\svchlp3.exe' ' (with hidden window)
- '%TEMP%\svchlp4.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\tmp757fa4c3.bat"' (with hidden window)
- '%TEMP%\svchlp5.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"' (with hidden window)
- '%TEMP%\6f9c4e93ec1c4b90baab.exe' ' (with hidden window)
- '%TEMP%\2a93afafe3b44bffba5b.exe' ' (with hidden window)
- '%TEMP%\8c86fc60306846e8b8de.exe' ' (with hidden window)
