Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\msiexec
- <SYSTEM32>\tasks\msiexecm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\<File name>e
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\lsass
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\totalcmd\language\services.exe
- <Current directory>\wudfhost.exe
- <Current directory>\480b7989c529f6
- C:\totalcmd\language\csrss.exe
- C:\totalcmd\language\886983d96e3d3e
- %TEMP%\ssuh4logm8
- %TEMP%\xorwkehkvb.bat
- nul
- %TEMP%\xqjxge5zss
- %TEMP%\tk4wfudpbs
- %TEMP%\s7uovtjdgc
- %ProgramFiles%\ekrn\886983d96e3d3e
- %TEMP%\yswhymyyc0
- %TEMP%\cvjlmvqqlw
- %TEMP%\k9i84whxbq
- %TEMP%\ptpyk3dobd
- %TEMP%\jcik5cwimp
- %TEMP%\qc1tbrt2el
- %TEMP%\cdwqg3p2qs
- %TEMP%\tw7fy2o6cz
- %TEMP%\4mmtmncwws
- %TEMP%\jkuzagp2oc
- %TEMP%\wd1e54ev4j
- %ProgramFiles(x86)%\internet explorer\signup\msiexec.exe
- %ProgramFiles(x86)%\internet explorer\signup\133006b48fb54b
- <Current directory>\69ddcba757bf72
- <Current directory>\smss.exe
- C:\far2\plugins\6203df4a6bafc7
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6cb0b6c459d5d3
- C:\users\default\application data\<File name>.exe
- C:\users\default\application data\bcdb3a02bc6a39
- C:\users\public\videos\sample videos\lsm.exe
- C:\users\public\videos\sample videos\101b941d020240
- <Current directory>\services.exe
- <Current directory>\c5b4cb5e9653cc
- C:\totalcmd\language\winlogon.exe
- C:\totalcmd\language\cc11b995f2a76d
- %TEMP%\nwafrz0do2
- %TEMP%\bzr6e1q5cn
- %ProgramFiles%\ekrn\csrss.exe
- C:\users\public\favorites\559fba5f8e4410
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6ccacd8608530f
- %WINDIR%\appcompat\programs\csrss.exe
- %WINDIR%\appcompat\programs\886983d96e3d3e
- C:\users\public\music\services.exe
- C:\users\public\music\c5b4cb5e9653cc
- %WINDIR%\setup\state\iexplore.exe
- %WINDIR%\setup\state\9db6e019d4f04e
- C:\far2\plugins\lsass.exe
- C:\totalcmd\language\c5b4cb5e9653cc
- C:\users\public\favorites\mdm.exe
- %TEMP%\btgxitmie1
Deletes the following files
- %TEMP%\ssuh4logm8
- %TEMP%\wd1e54ev4j
- %TEMP%\jkuzagp2oc
- %TEMP%\4mmtmncwws
- %TEMP%\tw7fy2o6cz
- %TEMP%\cdwqg3p2qs
- %TEMP%\qc1tbrt2el
- %TEMP%\jcik5cwimp
- %TEMP%\ptpyk3dobd
- %TEMP%\k9i84whxbq
- %TEMP%\cvjlmvqqlw
- %TEMP%\bzr6e1q5cn
- %TEMP%\yswhymyyc0
- %TEMP%\s7uovtjdgc
- %TEMP%\tk4wfudpbs
- %TEMP%\xqjxge5zss
- %TEMP%\nwafrz0do2
- %TEMP%\btgxitmie1
Network activity
Connects to
- '14#.#54.69.62':80
TCP
HTTP GET requests
- http://14#.#54.69.62/Low/CentralJavascript1Temporary/65/Dle/Eternalprocessorgameserver.php?EJ####################################################################################################...
- http://14#.#54.69.62/Low/CentralJavascript1Temporary/65/Dle/Eternalprocessorgameserver.php?DZ####################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\internet explorer\signup\msiexec.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\XOrWkEHkVb.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Music\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'%WINDIR%\Setup\State\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%WINDIR%\Setup\State\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'%WINDIR%\Setup\State\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Far2\Plugins\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Far2\Plugins\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Far2\Plugins\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 14 /tr "'<Current directory>\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 14 /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "msiexecm" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\msiexec.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\msiexec.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "msiexecm" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\msiexec.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'<Current directory>\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\XOrWkEHkVb.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>e" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'C:\Users\Default\Application Data\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>e" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Videos\Sample Videos\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\Sample Videos\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 7 /tr "'<Current directory>\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\ekrn\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\ekrn\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\ekrn\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Favorites\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Favorites\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
