Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = 'c:\k1197m1003\maejjd.exe c:\k1197m1003\QJQXGU~1.KJD'
Malicious functions
Injects code into
the following user processes:
- regsvcs.exe
Modifies file system
Creates the following files
- C:\k1197m1003\biplraj.mp3
- %HOMEPATH%\temp\biplraj.mp3
- C:\k1197m1003\eetnrianjr.msc
- C:\k1197m1003\iocsgqgxbs.mp3
- C:\k1197m1003\daqujheupe.jpg
- C:\k1197m1003\adgufr.dat
- C:\k1197m1003\oueit.icm
- C:\k1197m1003\tceg.cpl
- C:\k1197m1003\bsvujogi.log
- C:\k1197m1003\arcbcoe.ico
- C:\k1197m1003\ucnhrobd.exe
- C:\k1197m1003\fbtdmucuhl.bmp
- C:\k1197m1003\xwcrkrgu.jpg
- C:\k1197m1003\wbtstcmahk.xls
- %TEMP%\regsvcs.exe
- C:\k1197m1003\guiugf.nls
- C:\k1197m1003\qunrhnqum.dat
- C:\k1197m1003\cubfu.cpl
- C:\k1197m1003\qfxs.log
- C:\k1197m1003\kohw.ico
- C:\k1197m1003\qxwtvd.bmp
- C:\k1197m1003\egpgoam.jpg
- C:\k1197m1003\rwjwbwhd.dll
- C:\k1197m1003\verinkh.cpl
- C:\k1197m1003\pkckenp.exe
- C:\k1197m1003\knxp.ico
- C:\k1197m1003\maejjd.exe
- C:\k1197m1003\bjsvlfjkl.vbs
- C:\k1197m1003\qjqxgucegx.kjd
- C:\k1197m1003\hmuiltmoqu.dll
- %APPDATA%\remcos\logs.dat
Sets the 'hidden' attribute to the following files
- C:\k1197m1003\maejjd.exe
Network activity
UDP
- DNS ASK ni#####h.duckdns.org
- DNS ASK ni####ah.dynu.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\k1197m1003\maejjd.exe' qjqxgucegx.kjd
- '%TEMP%\regsvcs.exe'
