Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\Us2IqItuDaCB.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\Us2IqItuDaCB.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\K2aew74kXeQ0.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\K2aew74kXeQ0.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '%APPDATA%\Microsoft\conhost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\hzgNslhlpGkQ.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Audio HD Driver' = '%TEMP%\hzgNslhlpGkQ.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Audio HD Driver' = '%TEMP%\hzgNslhlpGkQ.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\hzgNslhlpGkQ.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}] 'StubPath' = '%TEMP%\hzgNslhlpGkQ.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Injects code into
the following user processes:
- perx.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:50323'
Modifies file system
Creates the following files
- %TEMP%\realtekaudio.exe
- %TEMP%\perx.exe
- %TEMP%\icqtoolbar.exe
- %TEMP%\k2aew74kxeq0.exe
- %TEMP%\us2iqitudacb.exe
- %APPDATA%\us2iqitudacb.exe
- %APPDATA%\k2aew74kxeq0.exe
- %APPDATA%\microsoft\conhost.exe
- %APPDATA%\31e7.0da
- %TEMP%\hzgnslhlpgkq.exe
- %APPDATA%\hzgnslhlpgkq.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\us2iqitudacb.exe
- %APPDATA%\us2iqitudacb.exe
- %TEMP%\k2aew74kxeq0.exe
- %APPDATA%\k2aew74kxeq0.exe
- %TEMP%\hzgnslhlpgkq.exe
- %APPDATA%\hzgnslhlpgkq.exe
Network activity
Connects to
- 'localhost':50323
TCP
HTTP GET requests
- http://re######waredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif?v9##################################################################
- http://www.google.com/
HTTP POST requests
- http://m0###ium.net/panel/connect.php
UDP
- DNS ASK re######waredevelopment.com
- DNS ASK m0###ium.net
- DNS ASK or####reentee.com
- DNS ASK sm####utosite.com
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\realtekaudio.exe'
- '%TEMP%\perx.exe'
- '%TEMP%\icqtoolbar.exe'
- '%TEMP%\icqtoolbar.exe' start%APPDATA%\dwm.exe%%APPDATA%
- '%TEMP%\icqtoolbar.exe' start%TEMP%\csrss.exe%%LOCALAPPDATA%\Temp
