Technical Information
Malicious functions
Creates and executes the following
- '%LOCALAPPDATA%\seaman\griddevice.exe'
- '%ALLUSERSPROFILE%\vpnguard\griddevice.exe'
- '%HOMEPATH%\parallelschedule.exe'
Executes the following
- '<SYSTEM32>\net.exe' stop WinDefend
Injects code into
the following user processes:
- parallelschedule.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\lqbjxcpx.msi
- %WINDIR%\temp\~df81cdf3dd4e7b809a.tmp
- %WINDIR%\installer\sourcehash{5f4b6496-723b-4c03-a8ad-68abce7cf80f}
- %WINDIR%\temp\~dff7f010b189d44196.tmp
- %WINDIR%\temp\~df9c46e8c6c32b6b8f.tmp
- %WINDIR%\temp\~dfb2cd81603f16f8ba.tmp
- %LOCALAPPDATA%\seaman\bugsplat.dll
- %LOCALAPPDATA%\seaman\comsupport.dll
- %LOCALAPPDATA%\seaman\dbghelp.dll
- %LOCALAPPDATA%\seaman\dvdsetting.dll
- %LOCALAPPDATA%\seaman\exceptionhandler.dll
- %LOCALAPPDATA%\seaman\griddevice.exe
- %LOCALAPPDATA%\seaman\nleresource.dll
- %LOCALAPPDATA%\seaman\nleservice.dll
- %LOCALAPPDATA%\seaman\nletransitionmgr.dll
- %LOCALAPPDATA%\seaman\slideshoweditor.ini
- %LOCALAPPDATA%\seaman\thiem.gep
- %LOCALAPPDATA%\seaman\toog.pthp
- %LOCALAPPDATA%\seaman\wsutilities.dll
- %LOCALAPPDATA%\seaman\ws_imageproc.dll
- %LOCALAPPDATA%\seaman\ws_log.dll
- %LOCALAPPDATA%\seaman\wsburn.dll
- %WINDIR%\temp\~dfc87002ca333f82b1.tmp
- %WINDIR%\temp\~dfc3c0198f3f877bb5.tmp
- %WINDIR%\temp\~df9e5a02c17b44ffed.tmp
- %WINDIR%\temp\~dffddeb963774a08e1.tmp
- %WINDIR%\temp\~df417c5984ecb3d484.tmp
- %WINDIR%\temp\~dfe4c1c916c1e7d0e1.tmp
- %WINDIR%\temp\~df8b66df53dbb13842.tmp
- %WINDIR%\temp\~df226db8925acb3b62.tmp
- %ALLUSERSPROFILE%\vpnguard\bugsplat.dll
- %ALLUSERSPROFILE%\vpnguard\comsupport.dll
- %ALLUSERSPROFILE%\vpnguard\dbghelp.dll
- %ALLUSERSPROFILE%\vpnguard\dvdsetting.dll
- %ALLUSERSPROFILE%\vpnguard\exceptionhandler.dll
- %ALLUSERSPROFILE%\vpnguard\griddevice.exe
- %ALLUSERSPROFILE%\vpnguard\nleresource.dll
- %ALLUSERSPROFILE%\vpnguard\nleservice.dll
- %ALLUSERSPROFILE%\vpnguard\nletransitionmgr.dll
- %ALLUSERSPROFILE%\vpnguard\slideshoweditor.ini
- %ALLUSERSPROFILE%\vpnguard\toog.pthp
- %ALLUSERSPROFILE%\vpnguard\wsburn.dll
- %ALLUSERSPROFILE%\vpnguard\wsutilities.dll
- %ALLUSERSPROFILE%\vpnguard\ws_imageproc.dll
- %ALLUSERSPROFILE%\vpnguard\ws_log.dll
- %ALLUSERSPROFILE%\vpnguard\thiem.gep
- %APPDATA%\vpnguard\xpfix.exe
- %TEMP%\80061f8.tmp
- %TEMP%\826717a.tmp
- %HOMEPATH%\parallelschedule.exe
- %TEMP%\8668b6b.tmp
Network activity
Connects to
- '91.##5.85.215':5506
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'cl####lare-dns.com':443
- '17#.#7.191.242':443
- '18#.#14.97.11':443
TCP
HTTP GET requests
- http://91.###.85.215:5506/LQBJXCPX.msi via 91.##5.85.215
Other
- 'cl####lare-dns.com':443
- '17#.#7.191.242':443
- '18#.#14.97.11':443
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK cl####lare-dns.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c net stop WinDefend
- '<SYSTEM32>\net1.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\msiexec.exe' /i %WINDIR%\Temp\LQBJXCPX.msi /quiet /norestart
- '<SYSTEM32>\cmd.exe' /c net stop WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled' (with hidden window)
- '<SYSTEM32>\msiexec.exe' /i %WINDIR%\Temp\LQBJXCPX.msi /quiet /norestart' (with hidden window)
