Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\taskhost
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- C:\intoruntime\5albbcgv42ayrwbjldc9.exe
- %TEMP%\isc7occcpp
- %TEMP%\jdyzljxrj1
- %TEMP%\fhco6xkdrz
- %TEMP%\fukdiscsnu
- %TEMP%\tvxhbwgv89
- %TEMP%\vxsjcv9tso
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- C:\documents and settings\svchost.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %TEMP%\8yqoinvdqu
- %TEMP%\9gguutemjq
- %TEMP%\yfrdhcabxs
- %TEMP%\tz82uxg33i
- %TEMP%\srow1lzsbe
- %TEMP%\hj8ddgmggn
- %TEMP%\ug8lkio9xn
- %TEMP%\ltlwfymrq0
- %TEMP%\dexmbua7fm
- %TEMP%\fk6xhxdhjn
- %TEMP%\69utgt7bec
- %TEMP%\8lbc4oopep
- %TEMP%\swrvmaetin
- C:\intoruntime\jp7yu5lrdph86qy0ff5jrhedca0nms.bat
- C:\intoruntime\1r8m5cjpxuo8fcplpm8ttwepznnila.bat
- C:\intoruntime\svcsession.exe
- C:\intoruntime\7ibwyteb1qpztp6fmqpvjcih5el0t1.vbe
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\audiodg.exe
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %TEMP%\519a6a29b4dec21c41be16a88fd7818c.tmp
- C:\documents and settings\smss.exe
- %TEMP%\qydollbgxlzffgjpmwuhbyogrwnlmnpz.exe
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- C:\documents and settings\69ddcba757bf72f7d36c464c71f42baab150b2b9
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\taskhost.exe
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\b75386f1303e64d8139363b71e44ac16341adf4e
- %TEMP%\urmjdgmana
- %TEMP%\5ok2b5xuy6
- %TEMP%\zsdrriwbw7
- %TEMP%\hrvgkpociy
- %TEMP%\sggthisrmq
- %TEMP%\kk4ewyabbs
- C:\intoruntime\ft4w2i1czt3kxkhcuhemiszwvy6vgj.vbe
- C:\documents and settings\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- C:\intoruntime\qydollbgxlzffgjpmwuhbyogrwnlmnpz.exe.ico
Deletes the following files
- %TEMP%\urmjdgmana
- %TEMP%\ltlwfymrq0
- %TEMP%\ug8lkio9xn
- %TEMP%\hj8ddgmggn
- %TEMP%\srow1lzsbe
- %TEMP%\tz82uxg33i
- %TEMP%\yfrdhcabxs
- %TEMP%\9gguutemjq
- %TEMP%\8yqoinvdqu
- %TEMP%\vxsjcv9tso
- %TEMP%\tvxhbwgv89
- %TEMP%\fukdiscsnu
- %TEMP%\qydollbgxlzffgjpmwuhbyogrwnlmnpz.exe
- %TEMP%\fhco6xkdrz
- %TEMP%\isc7occcpp
- %TEMP%\fk6xhxdhjn
- %TEMP%\dexmbua7fm
- %TEMP%\69utgt7bec
- %TEMP%\8lbc4oopep
- %TEMP%\swrvmaetin
- %TEMP%\kk4ewyabbs
- %TEMP%\sggthisrmq
- %TEMP%\hrvgkpociy
- %TEMP%\zsdrriwbw7
- %TEMP%\5ok2b5xuy6
- %TEMP%\jdyzljxrj1
- C:\intoruntime\qydollbgxlzffgjpmwuhbyogrwnlmnpz.exe.ico
Network activity
TCP
HTTP GET requests
- http://45.##7.67.221/dp3mvyagjzjfk9ftegl9homwi58uokdxinme81tpv9urb8/4kzu3trk5vqsetudhhmiey320/16d89f9f904651122437b0d707beaa33842a0c12.php?21####################################################...
- http://45.##7.67.221/dp3mvyagjzjfk9ftegl9homwi58uokdxinme81tpv9urb8/4kzu3trk5vqsetudhhmiey320/16d89f9f904651122437b0d707beaa33842a0c12.php?bb####################################################...
- http://45.##7.67.221/dp3mvyagjzjfk9ftegl9homwi58uokdxinme81tpv9urb8/4kzu3trk5vqsetudhhmiey320/phagn43uegn3ackrat1qk4lhobnjvyr0ce93nm/4f4deeb6e2c7d34593b0d8165ae11445.php?d0#####################...
UDP
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\intoruntime\Ft4w2i1czT3kXkHCuHeMisZWVy6vgj.vbe"
- 'C:\intoruntime\5albbcgv42ayrwbjldc9.exe' -pb944684e128deda5af8cd13e552acf30eb32b559
- '%WINDIR%\syswow64\wscript.exe' "C:\intoruntime\7ibWYTeB1qPzTp6fmqpVjCih5eL0t1.vbe"
- 'C:\intoruntime\svcsession.exe'
- '%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\taskhost.exe'
- '%TEMP%\qydollbgxlzffgjpmwuhbyogrwnlmnpz.exe' /stext "QYDOLLBGXLZFFGJPMWUHBYOGRWNLMNPZ.exe.ico"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intoruntime\jP7yU5LrDph86Qy0Ff5jrhEDcA0NmS.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intoruntime\1r8M5cjPXUo8FcPLpm8tTWEpZNniLa.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intoruntime\jP7yU5LrDph86Qy0Ff5jrhEDcA0NmS.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intoruntime\1r8M5cjPXUo8FcPLpm8tTWEpZNniLa.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Documents and Settings\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\taskhost.exe'" /rl HIGHEST /f
