Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\device information\microsoft compatibility
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
Patches code
in NTDLL dll
- dwm.exe process, ntdll.dll module
Modifies file system
Creates the following files
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
- %ProgramFiles%\internet explorer\installer.exe
- %ProgramFiles%\internet explorer\log.dll
- %ProgramFiles%\internet explorer\log.bin
Deletes following files that it created itself
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
Moves itself
- from <Full path to file> to %TEMP%\ceaietkpusaxktwm.tmp
Network activity
Connects to
- 'oo##8de.cn':8880
TCP
HTTP GET requests
- http://oo###de.cn:8880/getinstall64 via oo##8de.cn
UDP
- DNS ASK oo##8de.cn
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)
