Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Izzuacu' = 'regsvr32.exe /s %APPDATA%\Zaha\goviu.dll'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' VNlBtdM.dll,DllRegisterServer
Injects code into
the following system processes:
- %WINDIR%\syswow64\msiexec.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKLM>\Software\Microsoft\Internet Account Manager]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Modifies file system
Creates the following files
- C:\msdownld.tmp\as110fad.tmp\dws.dll
- %TEMP%\giapig.tmp
- %TEMP%\kidievn.tmp
- %TEMP%\olecnu.tmp
- %TEMP%\ceki.tmp
- %TEMP%\yqgidure.tmp
- %TEMP%\ewfab.tmp
- %TEMP%\ziivyxze.tmp
- %TEMP%\cyukzuih.tmp
- %TEMP%\iqquar.tmp
- %TEMP%\ambezoq.tmp
- %TEMP%\zetiyv.tmp
- %TEMP%\ylrayzus.tmp
- %TEMP%\etfa.tmp
- %TEMP%\pebeu.tmp
- %TEMP%\ufahc.tmp
- %TEMP%\etxexi.tmp
- %TEMP%\natoqum.tmp
- %TEMP%\oltugaet.tmp
- %TEMP%\atovv.tmp
- %APPDATA%\zaha\goviu.dll
- %APPDATA%\siyln\ugdoav.ydvi
- %APPDATA%\zyeh\invo.tum
- %APPDATA%\afpie\igdu.lysaw
- %APPDATA%\tasuo\avvunyw.xyfa
- %APPDATA%\ezvaes\saux.dyn
- %APPDATA%\wezyg\atkod.ozuzz
- %TEMP%\zuihiqi.tmp
- %APPDATA%\ymmac\isurigy.kuos
- %TEMP%\usidyx.tmp
- %TEMP%\usidyx.tmp-shm
- %TEMP%\oqeqaw.tmp
- %TEMP%\irfuhi.tmp
- %TEMP%\ucxig.tmp
- %TEMP%\erim.tmp
- %HOMEPATH%\documents\vnlbtdm.dll
- %TEMP%\alsi.tmp
- %APPDATA%\zyeh\invo.tmp
Deletes the following files
- C:\msdownld.tmp\as110fad.tmp\dws.dll
- %TEMP%\etfa.tmp
- %TEMP%\ylrayzus.tmp
- %TEMP%\zetiyv.tmp
- %TEMP%\ambezoq.tmp
- %TEMP%\iqquar.tmp
- %TEMP%\zuihiqi.tmp
- %TEMP%\cyukzuih.tmp
- %TEMP%\ewfab.tmp
- %TEMP%\yqgidure.tmp
- %TEMP%\ceki.tmp
- %TEMP%\olecnu.tmp
- %TEMP%\kidievn.tmp
- %TEMP%\pebeu.tmp
- %TEMP%\giapig.tmp
- %TEMP%\ufahc.tmp
- %TEMP%\natoqum.tmp
- %TEMP%\oltugaet.tmp
- %TEMP%\atovv.tmp
- %TEMP%\erim.tmp
- %TEMP%\ucxig.tmp
- %TEMP%\irfuhi.tmp
- %TEMP%\oqeqaw.tmp
- %TEMP%\usidyx.tmp
- %TEMP%\usidyx.tmp-shm
- %TEMP%\alsi.tmp
- %TEMP%\ziivyxze.tmp
- %TEMP%\etxexi.tmp
- %APPDATA%\zyeh\invo.tmp
Moves the following files
- from %APPDATA%\zyeh\invo.tum to %APPDATA%\zyeh\invo.tmp
Network activity
Connects to
- 'mi###anttra.at':443
TCP
HTTP GET requests
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK og###dedibl.at
- DNS ASK mi###anttra.at
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' VNlBtdM.dll,DllRegisterServer' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net config workstation' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net view /all' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net view /all /domain' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '%WINDIR%\syswow64\cmd.exe' /c net config workstation
- '%WINDIR%\syswow64\net.exe' config workstation
- '%WINDIR%\syswow64\net1.exe' config workstation
- '%WINDIR%\syswow64\cmd.exe' /c net view /all
- '%WINDIR%\syswow64\net.exe' view /all
- '%WINDIR%\syswow64\cmd.exe' /c net view /all /domain
- '%WINDIR%\syswow64\net.exe' view /all /domain
