Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = ''
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '' = ''
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %APPDATA%\dhelper.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\explorer.lnk
- <SYSTEM32>\tasks\microsoft localmanager[windows 7 enterprise]
Creates the following files on removable media
- <Drive name for removable media>:\doc001.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im lsm.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im dhelper.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\lsm.exe
Modifies file system
Creates the following files
- %APPDATA%\tempo\doc001.exe
- %APPDATA%\dhelper.exe
- %TEMP%\nsmd422.tmp\nsexec.dll
- %TEMP%\nswd411.tmp
- %TEMP%\nsbd25d.tmp\nsexec.dll
- %TEMP%\nsmd24d.tmp
- %TEMP%\nsrcca2.tmp\inetc.dll
- %TEMP%\javatemp\temps.7z1
- %TEMP%\javatemp\jare.7z1
- %TEMP%\javatemp\jar2.exe
- %TEMP%\nsrbaa8.tmp\inetc.dll
- %APPDATA%\temporx\uihost64.exe
- C:\doc001.exe
- %APPDATA%\temporx\uihost32.exe
- %APPDATA%\temporx\vid001.exe
- %TEMP%\vid.exe
- %ALLUSERSPROFILE%\{21920069-2192-2192-219200697785}\lsm.exe
- %TEMP%\nsr9231.tmp\inetc.dll
- %TEMP%\buff2.exe
- %TEMP%\nsm8beb.tmp\inetc.dll
- %TEMP%\java13.exe
- %TEMP%\java.exe
- %TEMP%\nsm7de7.tmp\inetc.dll
- %APPDATA%\tempo\nscpucnminer64.exe
- %APPDATA%\tempo\nscpucnminer32.exe
- %TEMP%\dhelper.exe
- D:\doc001.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\{21920069-2192-2192-219200697785}\lsm.exe
- %APPDATA%\dhelper.exe
Deletes the following files
- %TEMP%\nsm8beb.tmp\inetc.dll
- %TEMP%\nsr9231.tmp\inetc.dll
- %TEMP%\nsbd25d.tmp\nsexec.dll
- %TEMP%\nsmd422.tmp\nsexec.dll
Network activity
Connects to
- 'ru##p.ru':80
- 'kr##o.ru':80
- 'u.##21y.com':80
- '2n#.co':80
- '2n#.co':443
- 'kr#s.ru':80
- 'db###36c0c.pw':80
TCP
HTTP GET requests
- http://ru##p.ru/java.dat
- http://kr##o.ru/java13.dat
- http://u.##21y.com/buff2.dat
- http://u.##21y.com/VID.dat
- http://u.##21y.com/dhelper.dat
- http://kr#s.ru/javarx.dat
- http://u.##21y.com/oneplus.dat
- http://db###36c0c.pw/index.php?a=####################################################
Other
- '2n#.co':443
UDP
- DNS ASK ru##p.ru
- DNS ASK kr##o.ru
- DNS ASK u.##21y.com
- DNS ASK 2n#.co
- DNS ASK io#d.pw
- DNS ASK kr#s.ru
- DNS ASK db###36c0c.pw
- DNS ASK 82###997d3.pw
- DNS ASK 36###9cf30.pw
- DNS ASK 84###fe23c.pw
- DNS ASK ac###78fe1.pw
- DNS ASK b3###917af.pw
- DNS ASK 0b###73826.pw
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\tempo\doc001.exe'
- '%TEMP%\javatemp\jar2.exe'
- '%TEMP%\dhelper.exe' -pJavajre_set7z
- '%APPDATA%\temporx\vid001.exe'
- '%TEMP%\buff2.exe' -pBuff2jre_set7z
- '%TEMP%\vid.exe' -pJavajre_set7z
- '%TEMP%\java.exe' -pJavajre_set7z
- '%TEMP%\java13.exe' -pJavajre_set8z
- '%APPDATA%\dhelper.exe'
- '%TEMP%\java13.exe' -pJavajre_set8z' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C copy /b %temp%\Javatemp\ini.jwd %APPDATA%\cppredistx86.exe' (with hidden window)
- '%TEMP%\buff2.exe' -pBuff2jre_set7z' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /f /tn "Microsoft LocalManager[Windows 7 Enterprise]" /tr "%ALLUSERSPROFILE%\{21920069-2192-2192-219200697785}\lsm.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im lsm.exe' (with hidden window)
- '%TEMP%\dhelper.exe' -pJavajre_set7z' (with hidden window)
- '%TEMP%\java.exe' -pJavajre_set7z' (with hidden window)
- '%APPDATA%\temporx\vid001.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im dhelper.exe & start %APPDATA%\dhelper.exe' (with hidden window)
- '%APPDATA%\tempo\doc001.exe' ' (with hidden window)
- '%TEMP%\vid.exe' -pJavajre_set7z' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C copy /b %temp%\Javatemp\jare.7z1 + %temp%\Javatemp\temps.7z1 %APPDATA%\dhelper.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im lsm.exe
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /f /tn "Microsoft LocalManager[Windows 7 Enterprise]" /tr "%ALLUSERSPROFILE%\{21920069-2192-2192-219200697785}\lsm.exe"
- '%WINDIR%\syswow64\cmd.exe' /C copy /b %temp%\Javatemp\ini.jwd %APPDATA%\cppredistx86.exe
- '%WINDIR%\syswow64\cmd.exe' /C copy /b %temp%\Javatemp\jare.7z1 + %temp%\Javatemp\temps.7z1 %APPDATA%\dhelper.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im dhelper.exe & start %APPDATA%\dhelper.exe
