Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\iexplore
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
- %TEMP%\eyozrsutll
- %TEMP%\rhxrqaypqd
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\9ejtwtonka
- %TEMP%\3iqi1baece
- %TEMP%\bcl0ebnapl
- %TEMP%\0b1dnjtt0v
- %TEMP%\2agu4rp4ak
- %TEMP%\yj4nugrnkl
- %TEMP%\n0mtwk0u1h
- %TEMP%\pc90cfeohu
- %TEMP%\qdh56k9bc3
- %TEMP%\xz16x5srvg
- %TEMP%\h8zdnyqxrz
- %ProgramFiles(x86)%\microsoft office\office10\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\microsoft office\office10\iexplore.exe
- C:\users\public\favorites\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\users\public\favorites\dwm.exe
- %ProgramFiles(x86)%\opera\29.0.1795.47\localization\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %ProgramFiles(x86)%\opera\29.0.1795.47\localization\audiodg.exe
- nul
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- %TEMP%\ip0vw73reu
- %TEMP%\mz0ouwv91b
Deletes the following files
- %TEMP%\h8zdnyqxrz
- %TEMP%\xz16x5srvg
- %TEMP%\qdh56k9bc3
- %TEMP%\pc90cfeohu
- %TEMP%\n0mtwk0u1h
- %TEMP%\yj4nugrnkl
- %TEMP%\2agu4rp4ak
- %TEMP%\0b1dnjtt0v
- %TEMP%\bcl0ebnapl
- %TEMP%\3iqi1baece
- %TEMP%\9ejtwtonka
- %TEMP%\rhxrqaypqd
- %TEMP%\eyozrsutll
- %TEMP%\ip0vw73reu
- %TEMP%\mz0ouwv91b
Network activity
TCP
HTTP GET requests
- http://ko####cika.online/pzqsdvfcxxemmpkn18s8b28czrvulqxhlbrp0o5u9g24yqwh7om61gd/vubwa2hk92cdmkgwygyp9lh4lazlr8us8ac142iwmtyjne7s5i95vv3qcak135fs54euvrsdd6p/8a1019e3420203c213446072e486d87ea406...
- http://ko####cika.online/pzqsdvfcxxemmpkn18s8b28czrvulqxhlbrp0o5u9g24yqwh7om61gd/vubwa2hk92cdmkgwygyp9lh4lazlr8us8ac142iwmtyjne7s5i95vv3qcak135fs54euvrsdd6p/xjp04fqt2r9hm4ysdu02q7ibtjsx4lfbp38c...
UDP
- DNS ASK ko####cika.online
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\microsoft office\office10\iexplore.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Opera\29.0.1795.47\localization\audiodg.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\Office10\iexplore.exe'" /rl HIGHEST /f
