Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'ImagePath' = 'cmd /c cd /d "C:\Users\Public\Videos\gNErICDX\" && start "" "C:\Users\Public\Videos\gNErICDX\thYfGjq2.exe"'
Creates the following services
- 'Webview Helper' cmd /c cd /d "C:\Users\Public\Videos\gNErICDX\" && start "" "C:\Users\Public\Videos\gNErICDX\thYfGjq2.exe"
Malicious functions
Patches code
in NTDLL dll
- app.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\mmdv\readme.md
- %ALLUSERSPROFILE%\mmdv\install.exe
- %ALLUSERSPROFILE%\mmdv\app.exe._
- %ALLUSERSPROFILE%\mmdv\app.exe
- %ALLUSERSPROFILE%\mmdv\view.dat
- %ALLUSERSPROFILE%\mmdv\web.dat
- %ALLUSERSPROFILE%\mmdv\view.conf
- C:\users\public\videos\boxtkbmy
- C:\users\public\videos\gnericdx\readme.md
- C:\users\public\videos\gnericdx\view.conf
- %ALLUSERSPROFILE%\view.conf
- C:\users\public\videos\gnericdx\124.exe
- C:\users\public\videos\gnericdx\faq.md
- C:\users\public\videos\gnericdx\libcef.dll
- %TEMP%\dtl20d2.tmp\language\instui\en-us.ini
- %TEMP%\dtl20d2.tmp\language\instui\zh-cn.ini
- %TEMP%\dtl20d2.tmp\dtlinstui.dll
- %TEMP%\dtl20d2.tmp\dtlmanualupdate.dll
- %TEMP%\dtl20d2.tmp\dtlnetwork.dll
- %TEMP%\dtl20d2.tmp\dtlzcom.dll
- %TEMP%\dtl20d2.tmp\pcid.dll
- %TEMP%\dtl20d2.tmp\substat.dll
- %APPDATA%\drivethelife\dtlconfig\data.ini
- C:\users\public\videos\gnericdx\license.md
- %WINDIR%\temp\~pp7710.tmp
- %WINDIR%\temp\~pp777d.tmp
Deletes following files that it created itself
- C:\users\public\videos\boxtkbmy
- %ALLUSERSPROFILE%\mmdv\app.exe._
- %ALLUSERSPROFILE%\mmdv\view.dat
- %ALLUSERSPROFILE%\mmdv\web.dat
- %ALLUSERSPROFILE%\mmdv\readme.md
- %ALLUSERSPROFILE%\mmdv\view.conf
- %WINDIR%\temp\~pp7710.tmp
- %WINDIR%\temp\~pp777d.tmp
Moves the following files
- from C:\users\public\videos\gnericdx\124.exe to C:\users\public\videos\gnericdx\thyfgjq2.exe
- from %ALLUSERSPROFILE%\mmdv\app.exe to \:dsl
Network activity
Connects to
- 'localhost':49695
- 'ip#.#pdrv.com':80
- '20#.#6.30.129':30308
TCP
HTTP POST requests
- http://ip#.#pdrv.com/api/clientevent
Other
- 'localhost':49695
- 'localhost':49696
UDP
- DNS ASK di######.integrate.updrv.com
- DNS ASK on#####.integrate.updrv.com
- DNS ASK in#.####behavior.updrv.com
- DNS ASK ip#.#pdrv.com
- 'di######.integrate.updrv.com':3800
- 'in#.####behavior.updrv.com':6130
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\mmdv\app.exe'
- '%ALLUSERSPROFILE%\mmdv\install.exe'
- 'C:\users\public\videos\gnericdx\thyfgjq2.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Users\Public\Videos\gNErICDX\" && start "" "C:\Users\Public\Videos\gNErICDX\thYfGjq2.exe"
