Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\62c4adc256c91b91974afdce7fae6145] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\62c4adc256c91b91974afdce7fae6145] 'ImagePath' = 'rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main'
- [<HKLM>\System\CurrentControlSet\Services\6c23af60d634372a613371f583c960f8] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\6c23af60d634372a613371f583c960f8] 'ImagePath' = 'rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main'
- [<HKLM>\System\CurrentControlSet\Services\385534695ba4401292896a6425cd9014] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\385534695ba4401292896a6425cd9014] 'ImagePath' = 'rundll32.exe "%WINDIR%\vebgir.dll" ZMgTPDhXDb'
Creates the following services
- '62c4adc256c91b91974afdce7fae6145' rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main
- '6c23af60d634372a613371f583c960f8' rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main
- '385534695ba4401292896a6425cd9014' rundll32.exe "%WINDIR%\vebgir.dll" ZMgTPDhXDb
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /IM firefox.exe /f
Installs hooks to intercept notifications
on window messages:
- Handler for all processes: %ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll
- Handler for all processes: %ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\rundll32.exe
Modifies file system
Creates the following files
- %TEMP%\nsmba2b.tmp\ushgyyvxsl.map
- %ProgramFiles(x86)%\chrome extension manager\uninstall.tar
- %ProgramFiles(x86)%\chrome extension manager\infile.cab
- %ProgramFiles(x86)%\chrome extension manager\chrome_manager.dll
- %WINDIR%\vebgir.dll
- %ProgramFiles(x86)%\chrome extension manager\infile_x64.cab
- %ProgramFiles(x86)%\chrome extension manager\chrome_manager_x64.dll
- %TEMP%\nsrbda6.tmp\execdos.dll
- <SYSTEM32>\grouppolicy\adm\chrome.adm
- <SYSTEM32>\grouppolicy\machine\template.pol
- %WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\fd81251d653f60adf1e8706c2a6a890f
- %WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\1268cbc3fb3f239903d30433e47d25ce
- %WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\43cffaa17edf9459c35bdbab8e2f1447
- %WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\d5c11b966ce62d89fa0df42a2ec98d76
- %TEMP%\nsrbda6.tmp\nsexec.dll
- %TEMP%\nsrbda6.tmp\simplesc.dll
- %TEMP%\nsrbda6.tmp\inetc.dll
- %TEMP%\nsrbda6.tmp\ipconfig.dll
- %TEMP%\nsrbda6.tmp\md5dll.dll
- %TEMP%\nsrbda6.tmp\moreinfo.dll
- %TEMP%\nsrbda6.tmp\system.dll
- %TEMP%\nsmba2b.tmp\bfgboxzpok.dll
- %ProgramFiles(x86)%\chrome extension manager\msg.inf
- %ProgramFiles(x86)%\chrome extension manager\msg.exe
Deletes the following files
- <SYSTEM32>\grouppolicy\machine\template.pol
- %WINDIR%\vebgir.dll
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %WINDIR%\vebgir.dll
Network activity
UDP
- DNS ASK ta####chnology.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_WidgetWin_1' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MozillaWindowClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d kocbepmfamjimgdjfobnecfcdmlooncl;file:///C:/Windows/Installer/{f2c67197-10d8-2cfc-7579-409aff4...' (with hidden window)
- '%WINDIR%\syswow64\gpupdate.exe' /force' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main --install-run' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /IM firefox.exe /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d kocbepmfamjimgdjfobnecfcdmlooncl;file:///C:/Windows/Installer/{f2c67197-10d8-2cfc-7579-409aff4...
- '%WINDIR%\syswow64\gpupdate.exe' /force
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main --install-run
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\vebgir.dll" ZMgTPDhXDb
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main a4Nft0A2a Wb5UwVFib
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main Q0QXqyD3D YELXthBzC
- '<SYSTEM32>\raserver.exe' /offerraupdate
