Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowss\data\servicerun0
- <SYSTEM32>\tasks\windowss\data\servicerun1
- <SYSTEM32>\tasks\windowss\data\servicerun2
- <SYSTEM32>\tasks\windowss\data\servicerun3
- <SYSTEM32>\tasks\windowss\data\servicerun
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\attrib.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\windows\updater.exe
- %APPDATA%\windows\errorfix.exe
- %APPDATA%\roamer.exe
- %APPDATA%\systemservice.vbs
- %TEMP%\roamer.exe
- %TEMP%\systemservice.vbs
- %LOCALAPPDATA%\roamer.exe
- %LOCALAPPDATA%\systemservice.vbs
- %PROGRAMDATA%\roamer.exe
- %PROGRAMDATA%\systemservice.vbs
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\systemidle.exe
- %APPDATA%\systemservice.vbs
- %TEMP%\roamer.exe
- %LOCALAPPDATA%\roamer.exe
- %PROGRAMDATA%\systemservice.vbs
- %PROGRAMDATA%\roamer.exe
- %LOCALAPPDATA%\systemservice.vbs
- %APPDATA%\roamer.exe
- %TEMP%\systemservice.vbs
Moves the following files
- from %APPDATA%\windows\updater.exe to %PROGRAMDATA%\systemidle.exe
- from %PROGRAMDATA%\systemidle.exe to %PROGRAMDATA%\systemidle.exe
Network activity
UDP
- DNS ASK y4###3b1l.ru
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%APPDATA%\windows\updater.exe'
- '%APPDATA%\windows\errorfix.exe'
- '%PROGRAMDATA%\systemidle.exe'
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\SystemService.vbs"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun3 /tr "%PROGRAMDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 5 /f' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\Roamer.exe"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%LOCALAPPDATA%\SystemService.vbs"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun2 /tr "%LOCALAPPDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 9 /f' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%LOCALAPPDATA%\Roamer.exe"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%TEMP%\SystemService.vbs"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun1 /tr "%TEMP%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 12 /f' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\SystemService.vbs"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun0 /tr "%APPDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 6 /f' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\Roamer.exe"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h %userprofile%\AppData\Roaming\Windows' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\SystemIdle.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun /tr "%PROGRAMDATA%\SystemIdle.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%TEMP%\Roamer.exe"' (with hidden window)
- '%PROGRAMDATA%\systemidle.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun /tr "%PROGRAMDATA%\SystemIdle.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\SystemService.vbs"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun3 /tr "%PROGRAMDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 5 /f
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\Roamer.exe"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%LOCALAPPDATA%\SystemService.vbs"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun2 /tr "%LOCALAPPDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 9 /f
- '%WINDIR%\syswow64\attrib.exe' +s +h "%LOCALAPPDATA%\Roamer.exe"
- '%WINDIR%\syswow64\attrib.exe'
- '%WINDIR%\syswow64\attrib.exe' +s +h "%TEMP%\SystemService.vbs"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%TEMP%\Roamer.exe"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\SystemService.vbs"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun0 /tr "%APPDATA%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 6 /f
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\Roamer.exe"
- '%WINDIR%\syswow64\attrib.exe' +s +h %userprofile%\AppData\Roaming\Windows
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\SystemIdle.exe"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windowss\Data\ServiceRun1 /tr "%TEMP%\SystemService.vbs" /st 00:00 /sc once /du 9999:59 /ri 12 /f
- '<SYSTEM32>\taskeng.exe' {1828FC5E-30BA-4714-999F-F10CC1CA5B74} S-1-5-21-1960123792-2022915161-3775307078-1001:ljlvgaqkzin\user:Interactive:[1]
