Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\C_20002\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%ProgramFiles(x86)%\mIRC\defaults\scripts\explorer.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"C:\totalcmd\LANGUAGE\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<SYSTEM32>\msident\winlogon.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%ALLUSERSPROFILE%\Mozilla\logs\lsass.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\RmClient\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\wuwebv\services.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<SYSTEM32>\netmsg\winlogon.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\services
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\c_20002\taskhost.exe
- %WINDIR%\syswow64\netmsg\cc11b995f2a76da408ea6a601e682e64743153ad
- %WINDIR%\syswow64\netmsg\winlogon.exe
- %WINDIR%\syswow64\wuwebv\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- %WINDIR%\syswow64\wuwebv\services.exe
- nul
- %TEMP%\bsl0488ciu.bat
- %TEMP%\rvnt5xfkjo
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\559fba5f8e44108851927af432f0edac6117c574
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\mdm.exe
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\csrss.exe
- %WINDIR%\syswow64\rmclient\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %ALLUSERSPROFILE%\mozilla\logs\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- %ALLUSERSPROFILE%\mozilla\logs\lsass.exe
- %WINDIR%\syswow64\msident\cc11b995f2a76da408ea6a601e682e64743153ad
- %WINDIR%\syswow64\msident\winlogon.exe
- C:\totalcmd\language\b75386f1303e64d8139363b71e44ac16341adf4e
- C:\totalcmd\language\taskhost.exe
- %ProgramFiles(x86)%\mirc\defaults\scripts\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- %ProgramFiles(x86)%\mirc\defaults\scripts\explorer.exe
- %WINDIR%\syswow64\c_20002\b75386f1303e64d8139363b71e44ac16341adf4e
- %WINDIR%\syswow64\rmclient\csrss.exe
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\886983d96e3d3e31032c679b2d4ea91b6c05afef
Deletes the following files
- %TEMP%\rvnt5xfkjo
Network activity
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\netmsg\winlogon.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\bsl0488cIU.bat"' (with hidden window)
- '%WINDIR%\syswow64\netmsg\winlogon.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\C_20002\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%ProgramFiles(x86)%\mIRC\defaults\scripts\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\msident\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Mozilla\logs\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\RmClient\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\bsl0488cIU.bat"
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<SYSTEM32>\wuwebv\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\netmsg\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe'" /rl HIGHEST /f
