Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HelpPane' = '%TEMP%\lu.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HelpPane' = '%TEMP%\lu.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\ombuq\Kuaizip_Setup_7654_1056939.exe' (downloaded from the Internet)
- '%TEMP%\ombuq\HNInstall_Setup_1690160397_7654_56939.exe' (downloaded from the Internet)
- '%TEMP%\ombuq\V9._87931_20170114151847.exe' (downloaded from the Internet)
- '%TEMP%\ombuq\as3550015.exe' (downloaded from the Internet)
Executes the following:
- '%TEMP%\lsass.exe'
- '%TEMP%\ombuq\Kuaizip_Setup_7654_1056939.exe' -jingmo
- '%TEMP%\ombuq\HNInstall_Setup_1690160397_7654_56939.exe'
- '%TEMP%\ombuq\as3550015.exe'
- '%TEMP%\ombuq\V9._87931_20170114151847.exe'
- '%TEMP%\lu.exe'
- '%TEMP%\HelpPane.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\system\kuai.txt
- %TEMP%\ombuq\Kuaizip_Setup_7654_1056939.exe
- %WINDIR%\system\xhjsb.txt
- %TEMP%\ombuq\HNInstall_Setup_1690160397_7654_56939.exe
- %WINDIR%\inf\b
- %TEMP%\ombuq\V9._87931_20170114151847.exe
- %TEMP%\ombuq\as3550015.exe
- %WINDIR%\system\qqllq.txt
Moves the following files:
- from %TEMP%\HelpPane.exe to %TEMP%\255796\...\TemporaryFile
- from %TEMP%\HelpPane.exe to %TEMP%\276390\...\TemporaryFile
- from %TEMP%\HelpPane.exe to %TEMP%\296890\...\TemporaryFile
- from %TEMP%\HelpPane.exe to %TEMP%\235328\...\TemporaryFile
- from %TEMP%\HelpPane.exe to %TEMP%\189609\...\TemporaryFile
- from %TEMP%\HelpPane.exe to %TEMP%\214390\...\TemporaryFile
- from %TEMP%\lsass.exe to %TEMP%\221187\...\TemporaryFile
Moves itself:
- from <Full path to file> to %TEMP%\180171\...\TemporaryFile
Network activity:
Connects to:
- 'dl.###chihuo.com':8800
- 'localhost':1044
- 'd.###note.com':80
- 'dl.##rjxz.com':80
- '12##.ip138.com':80
- 'mi##.wcd.qq.com':80
- 'dl.#kiki.cn':80
- 'ab#.#h2w.com':80
TCP:
HTTP GET requests:
- http://dl.#kiki.cn/dl/approval/as3550015.exe
- http://dl.##rjxz.com/downloads/special/kyzipx/Kuaizip_Setup_7654_1056939.exe
- http://d.###note.com/downloads/7654/HNInstall_Setup_1690160397_7654_56939.exe
- http://mi##.wcd.qq.com/app?pa#####################################
- http://12##.ip138.com/ic.asp
- http://ab#.#h2w.com/bbb.jpg
UDP:
- DNS ASK dl.###chihuo.com
- DNS ASK dl.##rjxz.com
- DNS ASK d.###note.com
- DNS ASK dl.#kiki.cn
- DNS ASK mi##.wcd.qq.com
- DNS ASK 12##.ip138.com
- DNS ASK ab#.#h2w.com
