Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe1.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe2.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe3.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\dxgxe3.ocx
- <Current directory>\9db11000
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'sw###zone.co':443
- 'ta##a.mx':443
- 'as##ref.ma':80
TCP
HTTP GET requests
- http://as##ref.ma/old_assaref/A2B3P/
Other
- 'sw###zone.co':443
- 'ta##a.mx':443
UDP
- DNS ASK sw###zone.co
- DNS ASK ta##a.mx
- DNS ASK as##ref.ma
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe1.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe2.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\dxgxe3.ocx' (with hidden window)
