Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\BootSys.url
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\msdtc.exe
Modifies file system:
Creates the following files:
- %TEMP%\wcd3hodn.0.cs
- %TEMP%\wcd3hodn.cmdline
- %TEMP%\wcd3hodn.out
Sets the 'hidden' attribute to the following files:
- C:\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe
Deletes the following files:
- %TEMP%\wcd3hodn.cmdline
- %TEMP%\wcd3hodn.0.cs
- %TEMP%\wcd3hodn.out
Moves the following files:
- from <Full path to file> to C:\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe
Network activity:
Connects to:
- 'wp#d':80
- 'ip###ger.com':443
- '10#.#34.34.48':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://10#.#34.34.48/builds/f707db00b39990ed0bdacadf4603106f/Gefest.exe
UDP:
- DNS ASK wp#d
- DNS ASK ip###ger.com
Miscellaneous:
Executes the following:
- '<SYSTEM32>\spiisupd.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\rcp.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\sdbinst.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\utilman.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\diantz.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\dvdupgrd.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\msdtc.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\ntvdm.exe' -f -i1 -w -a <SYSTEM32>\krnl386.exe
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wcd3hodn.cmdline"
