Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\emproxy] 'ImagePath' = '%ALLUSERSPROFILE%\DRM\emproxy\rsmain.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\emproxy] 'Start' = '00000002'
Malicious functions:
Injects code into
the following system processes:
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\DRM\emproxy\rscom1.dsm
- %ALLUSERSPROFILE%\DRM\emproxy\rscom.dll
- %ALLUSERSPROFILE%\DRM\emproxy\rsmain.exe
- %ALLUSERSPROFILE%\DRM\emproxy\dmvuvrjq
- %ALLUSERSPROFILE%\DRM\emproxy\rsmain.exe.log
- %TEMP%\RarSFX0\rsmain.exe
- %TEMP%\RarSFX0\rscom.dll
- %TEMP%\RarSFX0\sdfgf.dll
- %TEMP%\RarSFX0\rsmain.exe.log
- %TEMP%\RarSFX0\rscom1.dsm
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\DRM\emproxy\rsmain.exe
- %ALLUSERSPROFILE%\DRM\emproxy\rscom1.dsm
- %ALLUSERSPROFILE%\DRM\emproxy\rscom.dll
Deletes the following files:
- %TEMP%\RarSFX0\rsmain.exe.log
- %TEMP%\RarSFX0\rscom1.dsm
- %TEMP%\RarSFX0\rscom.dll
- <Full path to file>
- %TEMP%\RarSFX0\rsmain.exe
Network activity:
Connects to:
- '<LOCALNET>.0.18':1357
- '<LOCALNET>.0.19':1357
- '<LOCALNET>.0.20':1357
- '<LOCALNET>.0.17':1357
- '<LOCALNET>.0.14':1357
- '<LOCALNET>.0.15':1357
- '<LOCALNET>.0.16':1357
- '<LOCALNET>.0.25':1357
- '<LOCALNET>.0.26':1357
- '<LOCALNET>.0.27':1357
- '<LOCALNET>.0.24':1357
- '<LOCALNET>.0.21':1357
- '<LOCALNET>.0.22':1357
- '<LOCALNET>.0.23':1357
- '<LOCALNET>.0.5':1357
- '<LOCALNET>.0.102':80
- '<LOCALNET>.0.6':1357
- '<LOCALNET>.0.4':1357
- '<LOCALNET_GATEWAY>':1357
- '<LOCALNET>.0.102':12345
- '<LOCALNET>.0.3':1357
- '<LOCALNET>.0.11':1357
- '<LOCALNET>.0.12':1357
- '<LOCALNET>.0.13':1357
- '<LOCALNET>.0.10':1357
- '<LOCALNET>.0.7':1357
- '<LOCALNET>.0.8':1357
- '<LOCALNET>.0.9':1357
TCP:
HTTP GET requests:
- http://19#.#68.0.102/09968F447EBBC391F3DFF4E8 via <LOCALNET>.0.102
- http://19#.#68.0.102/6E73EDFBE39928B858BE6302 via <LOCALNET>.0.102
UDP:
- DNS ASK 2�#### ?�� ;�eC����/�
- DNS ASK �#####�f�G�Q��hIS>
- DNS ASK �H#####�dUM-�ڭ��aPQy
- DNS ASK ��#####8J�ۤ`tS��� _)�
- DNS ASK ��###<Ae#��� �F/��O=E
- DNS ASK LK#####�b4���Ի�u7Ux
- DNS ASK H###.#�G��\�#ʉ�ʖ<
- DNS ASK ��#####�m���QIs�9���_a
- DNS ASK e�#####�|��c^��3^
- DNS ASK {2#####D�X��� �r��+� ?�
- DNS ASK ��#####� ���D}�S�+�Y<
- DNS ASK Cɤ#####�T�.5�n��q" �
- DNS ASK ��####N�~��=�Z<�m��/ i
- DNS ASK W$#####=p��Z�=_ߤ�hc-6
- DNS ASK {H#####1Z��N� Ӏ����
- DNS ASK � #####|=�& xA���̩tn�X
- DNS ASK �g#####�3�Lf�JӼ�S=��
- DNS ASK ��#####6����uT'2 ���]
- DNS ASK �#####��C�lI����% pO0�
- DNS ASK �u#####T&���*����
- DNS ASK �x#####�βK(�d6�M`��
- DNS ASK #####�}Bk�@�� �P}D,
- DNS ASK ��####�=ݧ�}E& ��!ʗ�
- DNS ASK ��#####"�`w�.��1�PU��
- '<LOCALNET>.0.22':1357
- 'localhost':1078
- 'localhost':1082
- 'localhost':1080
- '<LOCALNET>.0.21':1357
- 'localhost':1073
- '<LOCALNET>.0.18':1357
- '<LOCALNET>.0.19':1357
- '<LOCALNET>.0.20':1357
- 'localhost':1075
- '<LOCALNET>.0.23':1357
- 'localhost':1094
- '<LOCALNET_GATEWAY>':1357
- '<LOCALNET>.0.27':1357
- '<LOCALNET>.0.26':1357
- 'localhost':1092
- '<LOCALNET>.0.24':1357
- 'localhost':1085
- 'localhost':1087
- 'localhost':1089
- '<LOCALNET>.0.25':1357
- '<LOCALNET>.0.7':1357
- 'localhost':1050
- '<LOCALNET>.0.6':1357
- 'localhost':1048
- '<LOCALNET>.0.9':1357
- 'localhost':1055
- '<LOCALNET>.0.8':1357
- 'localhost':1053
- '<LOCALNET>.0.3':1357
- 'localhost':1041
- 'localhost':1038
- 'localhost':1357
- '<LOCALNET>.0.5':1357
- 'localhost':1045
- '<LOCALNET>.0.4':1357
- 'localhost':1043
- '<LOCALNET>.0.15':1357
- 'localhost':1067
- '<LOCALNET>.0.14':1357
- 'localhost':1065
- '<LOCALNET>.0.17':1357
- 'localhost':1071
- '<LOCALNET>.0.16':1357
- 'localhost':1069
- '<LOCALNET>.0.11':1357
- 'localhost':1059
- '<LOCALNET>.0.10':1357
- 'localhost':1057
- '<LOCALNET>.0.13':1357
- 'localhost':1063
- '<LOCALNET>.0.12':1357
- 'localhost':1061
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%ALLUSERSPROFILE%\DRM\emproxy\rsmain.exe'
- '%TEMP%\RarSFX0\rsmain.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe'
- '<SYSTEM32>\svchost.exe'
