Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = 'kdmgb.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\csrss.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\services.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\smss.exe
- <SYSTEM32>\alg.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, wsock32.dll module
- iexplore.exe process, urlmon.dll module
- iexplore.exe process, wininet.dll module
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <SYSTEM32>\kdmgb.exe
Deletes itself.
Network activity
Connects to
- '64.#8.184.2':80
Miscellaneous
Executes the following
- '%WINDIR%\explorer.exe'
