Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'rqlumrahvxcuwhew' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\iudzwatbamna.dll"'
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.welcometrack.biz/enter.html
Modifies file system
Creates the following files
- %TEMP%\nsq6623.tmp
- %TEMP%\nsk66a0.tmp\system.dll
- %WINDIR%\syswow64\iudzwatbamna.dll
- %WINDIR%\syswow64\numipimrtkplixte.exe
- %TEMP%\nsk66a0.tmp\nsisdl.dll
Deletes the following files
- %TEMP%\nsk66a0.tmp\nsisdl.dll
- %TEMP%\nsk66a0.tmp\system.dll
Network activity
UDP
- DNS ASK ad#.###estination.biz
- DNS ASK we####etrack.biz
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\iudzwatbamna.dll"
