Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\77e08ea871bab05e6686e3b93c98e9a3
- <SYSTEM32>\tasks\3a2a6d73970c0f8b740244ea880fd96e
- <SYSTEM32>\tasks\4a11c622e91e2c4071636ba61b7ca618
- <SYSTEM32>\tasks\1a7ffca4e145c61ae457cb3e07eaaa7a
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- C:\documents and settings\lsm32.exe
- C:\documents and settings\svchost32.exe
- C:\totalcmd\language\spoolsv32.exe
- C:\perflogs\admin\wudfhost32.exe
Network activity
Connects to
- 'cx####5.tmweb.ru':80
- 'vh###.timeweb.ru':443
TCP
HTTP GET requests
- http://cx####5.tmweb.ru/gwdk8ky/5rzm8strm1yfu9ehntysbq34xn13360xc6ip7yg34dpjlbdmkkfeaaywm7naf7opzikhg4bpcug5q0zwt2x5k/e13abfe11b5bb9473520496147d582e9111ba906.php?f5############################...
UDP
- DNS ASK cx####5.tmweb.ru
- DNS ASK vh###.timeweb.ru
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- 'C:\perflogs\admin\wudfhost32.exe'
