Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\zGCORgC.dll,DllRegisterServer
Injects code into
the following system processes:
- %WINDIR%\syswow64\msiexec.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\zgcorgc.dll
- %APPDATA%\teeq\lolylei.dll
Network activity
TCP
HTTP GET requests
- http://wm######xxbcxmucxmlc.com/files/april17.dll
- http://www.sn######hflwgthqismb.com/post.php
- http://www.ia######wohcxnhwtofa.com/post.php
HTTP POST requests
- http://wm######xxbcxmucxmlc.com/post.php
- http://oj######lftfkkuxxiqd.com/post.php
- http://pw######tsshkoibaake.com/post.php
- http://sn######hflwgthqismb.com/post.php
- http://ia######wohcxnhwtofa.com/post.php
UDP
- DNS ASK wm######xxbcxmucxmlc.com
- DNS ASK oj######lftfkkuxxiqd.com
- DNS ASK pw######tsshkoibaake.com
- DNS ASK sn######hflwgthqismb.com
- DNS ASK ia######wohcxnhwtofa.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\zGCORgC.dll,DllRegisterServer' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe'
