Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\centurylinkinstallersetup.exe
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isb16f.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\defb16e.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrb15d.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\strb15c.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbb14b.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\dotb13b.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\corb13a.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difb129.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fonb128.tmp
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setb118.tmp
- %TEMP%\b08a.tmp
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\0x0409.ini
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\setup.ini
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\setup.iss
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\setup.inx
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\setup.ini
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\setup.exe
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\md5sum.exe
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\license.rtf
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\layout.bin
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\issetup.dll
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\data1.hdr
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\data1.cab
- %TEMP%\{4bd7e0bf-5c61-4a5c-9e33-b18075621376}\disk1\0x0409.ini
- %TEMP%\rarsfx0\config.ini
- %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isb17f.tmp
- %WINDIR%\centurylinkinstallersetup.log
Moves the following files
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setb118.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fonb128.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difb129.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\corb13a.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\corecomp.ini
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\dotb13b.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\dotnetinstaller.exe
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbb14b.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\strb15c.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrb15d.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\defb16e.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isb16f.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
- from %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isb17f.tmp to %TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEF69E80-C174-41D0-ABC6-DC65EF6E69AF}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16AABB40-DAAA-47FC-B15C-D8332E456D5A}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D8F317A-73E4-42BB-A393-CA11DFE9AAF6}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C19E8063-4B6D-445A-B15C-7AEBE1711427}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB94BE6C-D4AC-4132-8928-3407C1C1D32A}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C4D4AB7-5329-48E7-9391-C21F853ABB47}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D11B08E-9BB5-4DF5-92CD-139CBA776CEE}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DA1AF05-DA0C-482F-9E38-2611035C53F5}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE706F74-A87E-46DD-B507-5A4F695FEEAC}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{248FD357-AF40-4AE3-9260-754EA43590B5}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13BC2224-7740-4313-BED6-7F38FF732B37}
- '%TEMP%\{dc426c37-4873-40d5-bcba-154db864e4d6}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC29374B-A3C9-42D6-B6AB-3F6D457A4937}
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (with hidden window)
