Trojan.MulDrop24.4452

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe

Modifies file system

Creates the following files

%TEMP%\rarsfx0\centurylinkinstallersetup.exe
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is2b9c.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def2b9b.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr2b7b.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str2b6a.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isb2b69.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\dot2b58.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\cor2b48.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif2b47.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon2b46.tmp
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set2b26.tmp
%TEMP%\2a3b.tmp
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\0x0409.ini
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\setup.ini
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\setup.iss
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\setup.inx
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\setup.ini
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\setup.exe
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\md5sum.exe
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\license.rtf
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\layout.bin
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\issetup.dll
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\data1.hdr
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\data1.cab
%TEMP%\{7316e9d9-bfcb-45be-8883-ac4b6ab58359}\disk1\0x0409.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is2bac.tmp
%WINDIR%\centurylinkinstallersetup.log

Moves the following files

from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set2b26.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon2b46.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif2b47.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\cor2b48.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\corecomp.ini
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\dot2b58.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\dotnetinstaller.exe
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isb2b69.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str2b6a.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr2b7b.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def2b9b.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is2b9c.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
from %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is2bac.tmp to %TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1184BF44-42B4-4415-BF35-E444B37272FE}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84406138-E18A-49DF-80F3-FFC34AF4F6FE}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F6BA99A8-2D66-4384-8090-891B9B6FE0A0}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F08DDF61-B2DC-450A-A9AB-20AAFCFF352E}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5393F786-5695-4072-9887-10D067A33825}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA97DF24-350E-4173-B5BF-688007430287}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{270168D8-C36A-415D-9F5A-AC54141FEF67}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A9A0E8F7-2C93-4A46-8936-D7762EB10D26}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5F1374B3-B82A-4849-A12E-930052755734}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ADFC6358-4A7C-4037-B85E-86FCDACE8E4D}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6223E464-1857-4B04-962D-0C84358EF431}
'%TEMP%\{77e45a7d-3796-4d92-89a4-bf4f1ff210fb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACE9C39C-8CAE-4F30-B1E5-7FCA5E8A0D08}
'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (with hidden window)