Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windefscan
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1073630] 'ImagePath' = 'cmd /c copy %WINDIR%\temp\1073302 C:\brwsrprcs.exe'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1077576] 'ImagePath' = 'cmd /c copy %WINDIR%\temp\1073411 C:\libcef.dll'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1079043] 'ImagePath' = 'cmd /c copy %WINDIR%\temp\1073505 C:\libcef.dat'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1079714] 'ImagePath' = 'C:\brwsrprcs.exe'
Creates the following services
- 'CreateSvcRpc_1073630' cmd /c copy %WINDIR%\temp\1073302 C:\brwsrprcs.exe
- 'CreateSvcRpc_1077576' cmd /c copy %WINDIR%\temp\1073411 C:\libcef.dll
- 'CreateSvcRpc_1079043' cmd /c copy %WINDIR%\temp\1073505 C:\libcef.dat
- 'CreateSvcRpc_1079714' C:\brwsrprcs.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\1073302
- %WINDIR%\temp\1073411
- %WINDIR%\temp\1073505
- C:\brwsrprcs.exe
- C:\libcef.dll
- C:\libcef.dat
Moves the following files
- from C:\brwsrprcs.exe to <SYSTEM32>\windefscan\brwsrprcs.exe
- from C:\libcef.dll to <SYSTEM32>\windefscan\libcef.dll
- from C:\libcef.dat to <SYSTEM32>\windefscan\libcef.dat
Network activity
Connects to
- 'at###898.com':6639
- 'at###898.com':80
UDP
- DNS ASK at###898.com
- 'localhost':49742
- 'localhost':53101
- 'localhost':53103
- 'localhost':57686
Miscellaneous
Creates and executes the following
- 'C:\brwsrprcs.exe'
- '<SYSTEM32>\windefscan\brwsrprcs.exe' -svc
Executes the following
- '<SYSTEM32>\cmd.exe' /c copy %WINDIR%\temp\1073302 C:\brwsrprcs.exe
- '<SYSTEM32>\cmd.exe' /c copy %WINDIR%\temp\1073411 C:\libcef.dll
- '<SYSTEM32>\cmd.exe' /c copy %WINDIR%\temp\1073505 C:\libcef.dat
- '<SYSTEM32>\svchost.exe' -Install
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -Install' (with hidden window)
- '<SYSTEM32>\windefscan\brwsrprcs.exe' -svc' (with hidden window)
