Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\is-q2jqf.tmp\<File name>.tmp
- %TEMP%\is-f3aac.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f3aac.tmp\innofunc.dll
- %TEMP%\download.zip
- %HOMEPATH%\mortises\msvcp140.dll
- %HOMEPATH%\mortises\qdata.tmp
- %HOMEPATH%\mortises\tier0.dll
- %HOMEPATH%\mortises\vcruntime140.dll
- %HOMEPATH%\mortises\vcruntime140_1.dll
- %HOMEPATH%\mortises\emjio.tmp
- %HOMEPATH%\mortises\height2normal.exe
- %ProgramFiles%\mortises\is-m6stl.tmp
- %ProgramFiles%\mortises\is-g2gf9.tmp
- %ProgramFiles%\mortises\is-17lri.tmp
- %ProgramFiles%\mortises\unins000.dat
- %HOMEPATH%\resource.dat
- %APPDATA%\nxonq1284_quc\glfw3.dll
- %APPDATA%\nxonq1284_quc\msvcp140.dll
- %APPDATA%\nxonq1284_quc\semifuddle.exe
- %APPDATA%\nxonq1284_quc\vcruntime140.dll
- %APPDATA%\nxonq1284_quc\vcruntime140_1.dll
- %ALLUSERSPROFILE%\venlnk\googlupdata.lnk
Moves the following files
- from %ProgramFiles%\mortises\is-m6stl.tmp to %ProgramFiles%\mortises\unins000.exe
- from %ProgramFiles%\mortises\is-g2gf9.tmp to %ProgramFiles%\mortises\innofunc.dll
- from %ProgramFiles%\mortises\is-17lri.tmp to %ProgramFiles%\mortises\190_1655549667_t_w.zip
Network activity
Connects to
- 'ba##u.com':443
- 'localhost':49697
- 'eu#######.#3.ap-east-1.amazonaws.com':443
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
- 'oc##.###01.amazontrust.com':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3c##############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b3##############
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
- http://oc##.###01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAwDRju4UmeqX8Wcgi5hyv0%3D
Other
- 'ba##u.com':443
- 'localhost':49697
- 'localhost':49698
- 'eu#######.#3.ap-east-1.amazonaws.com':443
UDP
- DNS ASK ba##u.com
- DNS ASK eu#######.#3.ap-east-1.amazonaws.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK oc##.###01.amazontrust.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-q2jqf.tmp\<File name>.tmp' /SL5="$C02B2,1546284,938496,<Full path to file>"
- '%HOMEPATH%\mortises\height2normal.exe'
Executes the following
- '%WINDIR%\explorer.exe'
- '%HOMEPATH%\mortises\height2normal.exe' ' (with hidden window)
