Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\OGCVPNOZ] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\OGCVPNOZ] 'ImagePath' = '%ALLUSERSPROFILE%\cmbpwncjehrk\qaklofxvfqzl.exe'
Creates the following services
- 'OGCVPNOZ' %ALLUSERSPROFILE%\cmbpwncjehrk\qaklofxvfqzl.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\dwm.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\cmbpwncjehrk\qaklofxvfqzl.exe
- %WINDIR%\temp\tioqjfsbszfw.sys
Network activity
Connects to
- 'xm#.#miners.com':2222
UDP
- DNS ASK xm#.#miners.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\cmbpwncjehrk\qaklofxvfqzl.exe'
Executes the following
- '<SYSTEM32>\sc.exe' delete "OGCVPNOZ"
- '<SYSTEM32>\sc.exe' create "OGCVPNOZ" binpath= "%ALLUSERSPROFILE%\cmbpwncjehrk\qaklofxvfqzl.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "OGCVPNOZ"
- '<SYSTEM32>\dwm.exe'
