Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\58586809\qrd.exe %TEMP%\58586809\scq-mvb'
Malicious functions:
Creates and executes the following:
- '%TEMP%\58586809\qrd.exe' %TEMP%\58586809\QJBAT
- '%TEMP%\58586809\qrd.exe' scq-mvb
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\58586809\kcx.dat
- %TEMP%\58586809\eoo.ico
- %TEMP%\58586809\tet.jpg
- %TEMP%\58586809\cdx.jpg
- %TEMP%\58586809\edc.bmp
- %TEMP%\58586809\bjg.docx
- %TEMP%\58586809\npg.mp3
- %TEMP%\58586809\fhr.jpg
- %TEMP%\58586809\oav.bmp
- %TEMP%\58586809\xgu.mp3
- %TEMP%\58586809\xur.jpg
- %TEMP%\58586809\dsv.bmp
- %TEMP%\58586809\gtf.docx
- %TEMP%\58586809\QJBAT
- %TEMP%\58586809\jeg.icm
- %TEMP%\58586809\wvu.docx
- %APPDATA%\Imminent\Monitoring\network.dat
- %APPDATA%\Imminent\Monitoring\system.dat
- %APPDATA%\Imminent\Logs\21-11-2017
- %TEMP%\58586809\hxo.dat
- %TEMP%\58586809\hqx.mp3
- %TEMP%\58586809\nlv.dat
- %TEMP%\58586809\whv.ppt
- %TEMP%\58586809\str.ppt
- %TEMP%\58586809\bsm.pdf
- %TEMP%\58586809\upd.ppt
- %TEMP%\58586809\ovk.ppt
- %TEMP%\58586809\pgd.jpg
- %TEMP%\58586809\xqo.xl
- %TEMP%\58586809\nec.dat
- %TEMP%\58586809\kxm.icm
- %TEMP%\58586809\vac.docx
- %TEMP%\58586809\avq.txt
- %TEMP%\58586809\qrd.exe
- %TEMP%\58586809\scq-mvb
- %TEMP%\58586809\kfj.mp3
- %TEMP%\58586809\hcd.jpg
- %TEMP%\58586809\lbv.bmp
- %TEMP%\58586809\kvv.xl
- %TEMP%\58586809\bam.xl
- %TEMP%\58586809\phq.mp4
- %TEMP%\58586809\gsb.mp3
- %TEMP%\58586809\xet.ico
- %TEMP%\58586809\jsa.txt
- %TEMP%\58586809\lee.jpg
- %TEMP%\58586809\qct.jpg
- %TEMP%\58586809\jpv.xl
- %TEMP%\58586809\urg.xl
- %TEMP%\58586809\khg.docx
- %TEMP%\58586809\pbg.dat
- %TEMP%\58586809\mrd.jpg
- %TEMP%\58586809\saq.jpg
Sets the 'hidden' attribute to the following files:
- %TEMP%\58586809\phq.mp4
- %TEMP%\58586809\pgd.jpg
- %TEMP%\58586809\pbg.dat
- %TEMP%\58586809\saq.jpg
- %TEMP%\58586809\qrd.exe
- %TEMP%\58586809\qct.jpg
- %TEMP%\58586809\nlv.dat
- %TEMP%\58586809\nec.dat
- %TEMP%\58586809\mrd.jpg
- %TEMP%\58586809\ovk.ppt
- %TEMP%\58586809\oav.bmp
- %TEMP%\58586809\npg.mp3
- %TEMP%\58586809\xet.ico
- %TEMP%\58586809\wvu.docx
- %TEMP%\58586809\whv.ppt
- %TEMP%\58586809\xur.jpg
- %TEMP%\58586809\xqo.xl
- %TEMP%\58586809\xgu.mp3
- %TEMP%\58586809\tet.jpg
- %TEMP%\58586809\str.ppt
- %TEMP%\58586809\scq-mvb
- %TEMP%\58586809\vac.docx
- %TEMP%\58586809\urg.xl
- %TEMP%\58586809\upd.ppt
- %TEMP%\58586809\fhr.jpg
- %TEMP%\58586809\eoo.ico
- %TEMP%\58586809\edc.bmp
- %TEMP%\58586809\hcd.jpg
- %TEMP%\58586809\gtf.docx
- %TEMP%\58586809\gsb.mp3
- %TEMP%\58586809\bjg.docx
- %TEMP%\58586809\bam.xl
- %TEMP%\58586809\avq.txt
- %TEMP%\58586809\dsv.bmp
- %TEMP%\58586809\cdx.jpg
- %TEMP%\58586809\bsm.pdf
- %TEMP%\58586809\kvv.xl
- %TEMP%\58586809\khg.docx
- %TEMP%\58586809\kfj.mp3
- %TEMP%\58586809\lee.jpg
- %TEMP%\58586809\lbv.bmp
- %TEMP%\58586809\kxm.icm
- %TEMP%\58586809\jeg.icm
- %TEMP%\58586809\hxo.dat
- %TEMP%\58586809\hqx.mp3
- %TEMP%\58586809\kcx.dat
- %TEMP%\58586809\jsa.txt
- %TEMP%\58586809\jpv.xl
Deletes the following files:
- %TEMP%\58586809\QJBAT
Network activity:
Connects to:
- 'cp####g.duckdns.org':777
UDP:
- DNS ASK cp####g.duckdns.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
