Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Ias] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Ias] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Ias\Parameters] 'ServiceDll' = '%WINDIR%\SysWOW64\IsAgent\IsaSvc.dll'
Creates the following services
- 'Ias' <SYSTEM32>\svchost.exe -k netsvcs
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\] 'IsaHelp.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\] 'svchost.exe' = '00000000'
Modifies file system
Creates the following files
- C:\asm\run.exe
- %WINDIR%\syswow64\isagent\skin\img\lock.png
- %WINDIR%\syswow64\isagent\skin\img\infogo.png
- %WINDIR%\syswow64\isagent\skin\img\hline.png
- %WINDIR%\syswow64\isagent\skin\img\help.png
- %WINDIR%\syswow64\isagent\skin\img\guest.png
- %WINDIR%\syswow64\isagent\skin\img\fault.png
- %WINDIR%\syswow64\isagent\skin\img\false.png
- %WINDIR%\syswow64\isagent\skin\img\device_info_normal.png
- %WINDIR%\syswow64\isagent\skin\img\device_info_hot.png
- %WINDIR%\syswow64\isagent\skin\img\device_info_disable.png
- %WINDIR%\syswow64\isagent\skin\img\deviceinfo.png
- %WINDIR%\syswow64\isagent\skin\img\default_menu_normal.png
- %WINDIR%\syswow64\isagent\skin\img\default_menu_hot.png
- %WINDIR%\syswow64\isagent\skin\img\default.png
- %WINDIR%\syswow64\isagent\skin\img\computer.png
- %WINDIR%\syswow64\isagent\skin\img\clock.png
- %WINDIR%\syswow64\isagent\skin\img\check_result_normal.png
- %WINDIR%\syswow64\isagent\skin\img\check_result_hot.png
- %WINDIR%\syswow64\isagent\skin\img\check_result_disable.png
- %WINDIR%\syswow64\isagent\skin\img\change_passwd_normal.png
- %WINDIR%\syswow64\isagent\skin\img\change_passwd_hot.png
- %WINDIR%\syswow64\isagent\skin\img\btn_lightblue_round_rect.png
- %WINDIR%\syswow64\isagent\skin\img\btn_green_round_rect.png
- %WINDIR%\syswow64\isagent\skin\img\btn_gray_round_rect.png
- %WINDIR%\syswow64\isagent\skin\img\btn_darkblue_round_rect.png
- %WINDIR%\syswow64\isagent\skin\img\menu_expand.png
- %WINDIR%\syswow64\isagent\skin\img\no_autoauth_hot.png
- %WINDIR%\syswow64\isagent\skin\img\no_autoauth_normal.png
- %WINDIR%\syswow64\isagent\skin\img\patch_repair_hot.png
- %WINDIR%\syswow64\isagent\hflogonflagfile.txt
- %WINDIR%\syswow64\isagent\skin\scrollbar.xml
- %WINDIR%\syswow64\isagent\skin\restart.xml
- %WINDIR%\syswow64\isagent\skin\requestremotescreenwnd.xml
- %WINDIR%\syswow64\isagent\skin\msgbox.xml
- %WINDIR%\syswow64\isagent\skin\isamainmenu.xml
- %WINDIR%\syswow64\isagent\skin\aboutwnd.xml
- %WINDIR%\syswow64\isagent\skin\img\waitting.gif
- %WINDIR%\syswow64\isagent\skin\img\vline.png
- %WINDIR%\syswow64\isagent\skin\img\visitor_code_normal.png
- %WINDIR%\syswow64\isagent\skin\img\visitor_code_hot.png
- %WINDIR%\syswow64\isagent\skin\img\user.png
- %WINDIR%\syswow64\isagent\skin\img\uninstall_ass_hot.png
- %WINDIR%\syswow64\isagent\skin\img\uninstall_ass_normal.png
- %WINDIR%\syswow64\isagent\skin\img\uninstall.png
- %WINDIR%\syswow64\isagent\skin\img\tool.png
- %WINDIR%\syswow64\isagent\skin\img\switch_user_normal.png
- %WINDIR%\syswow64\isagent\skin\img\switch_user_hot.png
- %WINDIR%\syswow64\isagent\skin\img\switch_user_disable.png
- %WINDIR%\syswow64\isagent\skin\img\success.png
- %WINDIR%\syswow64\isagent\skin\img\small_282.png
- %WINDIR%\syswow64\isagent\skin\img\scrollbar.bmp
- %WINDIR%\syswow64\isagent\skin\img\remotescreen.png
- %WINDIR%\syswow64\isagent\skin\img\remote.png
- %WINDIR%\syswow64\isagent\skin\img\reboot.png
- %WINDIR%\syswow64\isagent\skin\img\patch_repair_normal.png
- %WINDIR%\syswow64\infogofunmgr\asm6000\ö÷»ú·à »ðç½\event.txt.ini
- %WINDIR%\syswow64\isagent\skin\img\btn_close_normal.png
- %WINDIR%\syswow64\isagent\skin\img\btn_close_highlight.png
- %WINDIR%\syswow64\isagent\skin\img\btn_close_down.png
- %WINDIR%\syswow64\isagent\isauninstalldlg.dll
- %WINDIR%\syswow64\isagent\isatraymenu.zip
- %WINDIR%\syswow64\isagent\isatraymenu.dll
- %WINDIR%\syswow64\isagent\isasvc.dll
- %WINDIR%\syswow64\isagent\isasetup.exe
- %WINDIR%\syswow64\isagent\isamanage.dll
- %WINDIR%\syswow64\isagent\isahelp.exe
- %WINDIR%\syswow64\isagent\isactrl.dll
- %WINDIR%\syswow64\isagent\fault.png
- %WINDIR%\syswow64\isagent\fault.ico
- %WINDIR%\syswow64\isagent\false.png
- %WINDIR%\syswow64\isagent\false.ico
- %WINDIR%\syswow64\isagent\duilib.dll
- %WINDIR%\syswow64\isagent\dbghelp.dll
- %WINDIR%\syswow64\isagent\config.xml
- %WINDIR%\syswow64\isagent\authunpass.png
- %WINDIR%\syswow64\isagent\authpass.png
- %WINDIR%\syswow64\isagent\asmfunctionmgr.dll
- %WINDIR%\syswow64\isagent\asmassistant.ico
- %TEMP%\uzca8f.tmp
- C:\asm\isaagent.bin
- C:\asm\isadomainins.exe
- C:\asm\extend.zip
- C:\asm\config.xml
- C:\asm\10.235.11.100_issetup_agent.exe
- %WINDIR%\syswow64\isagent\offline.ico
- %WINDIR%\syswow64\isagent\success.ico
- %WINDIR%\syswow64\isagent\success.png
- %WINDIR%\syswow64\isagent\uam_uas.dll
- %WINDIR%\syswow64\isagent\skin\img\btn_blank_round_rect.png
- %WINDIR%\syswow64\isagent\skin\img\book.png
- %WINDIR%\syswow64\isagent\skin\img\auth_check_normal.png
- %WINDIR%\syswow64\isagent\skin\img\auth_check_hot.png
- %WINDIR%\syswow64\isagent\skin\img\auth_check_disable.png
- %WINDIR%\syswow64\isagent\skin\img\apply_remote_normal.png
- %WINDIR%\syswow64\isagent\skin\img\apply_remote_hot.png
- %WINDIR%\syswow64\isagent\skin\img\analyze_tool_normal.png
- %WINDIR%\syswow64\isagent\skin\img\analyze_tool_hot.png
- %WINDIR%\syswow64\isagent\skin\img\analyze_tool_disable.png
- %WINDIR%\syswow64\isagent\skin\uninstall.xml
- %WINDIR%\syswow64\isagent\skin\sub_menu.xml
- <SYSTEM32>\isalog.lnk
- <SYSTEM32>\isaview.lnk
- <SYSTEM32>\isaremove.lnk
- %WINDIR%\syswow64\isagent\isaagent.bin
- %WINDIR%\syswow64\isaagent.bin
- %WINDIR%\syswow64\isagent\wpcap.dll
- %WINDIR%\syswow64\isagent\pthreadvc.dll
- %WINDIR%\syswow64\isagent\packet.dll
- %WINDIR%\syswow64\isagent\npptools.dll
- %WINDIR%\syswow64\isagent\npf_x86.sys
- %WINDIR%\syswow64\isagent\npf_x64.sys
- %WINDIR%\syswow64\isagent\lcfhostfirewall.dll
- %WINDIR%\syswow64\isagent\lcfforcevlan.dll
- C:\asm\dbghelp.dll
- %WINDIR%\syswow64\isagent\skin\img\btn_blue_round_rect.png
- %WINDIR%\syswow64\infogofunmgr\asm6000\ö÷»ú·à »ðç½\event.txt
Deletes the following files
- C:\asm\dbghelp.dll
Moves the following files
- from %TEMP%\uzca8f.tmp to %WINDIR%\syswow64\isagent\setup.zip
Network activity
Connects to
- '10.##5.11.100':37527
UDP
- DNS ASK ba##u.com
- '10.##5.11.100':36533
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\asm\isadomainins.exe'
- 'C:\asm\10.235.11.100_issetup_agent.exe'
- '%WINDIR%\syswow64\isagent\isahelp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c Ewfmgr C: -commit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs
- '%WINDIR%\syswow64\cmd.exe' /c Ewfmgr C: -commit
