Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\INF\.NETFramework\CORPerfMonSymbols.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\launch adobe ccxprocess
- <SYSTEM32>\tasks\xccprocess
- <SYSTEM32>\tasks\microsoft\windows\windows update listner
- <SYSTEM32>\tasks\microsoft\microsoft launcher
- <SYSTEM32>\tasks\sihost
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\runtimebroker
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'ImagePath' = '%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\aswArPot.sys] 'ImagePath' = '%WINDIR%\temp\aswArPot.bin'
Creates the following services
- 'System Diagnostics Host' %WINDIR%\SysWOW64\SystemDiagnosticsHost.exe
- 'aswArPot.sys' %WINDIR%\temp\aswArPot.bin
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes
Launches a large number of processes
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\securityhealthservice.exe
Modifies file system
Creates the following files
- %TEMP%\tmp138e.tmp.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %TEMP%\wqtv5b4q\wqtv5b4q.0.cs
- %TEMP%\wqtv5b4q\wqtv5b4q.cmdline
- %TEMP%\wqtv5b4q\wqtv5b4q.out
- %TEMP%\csc41f1f867ff434a3d8d6c3e394b1389a.tmp
- %TEMP%\res4fad.tmp
- %TEMP%\tmp49c1.tmp
- %WINDIR%\inf\.netframework\corperfmonsymbols.exe
- %TEMP%\bkztbqqd\bkztbqqd.0.cs
- %TEMP%\bkztbqqd\bkztbqqd.cmdline
- %TEMP%\bkztbqqd\bkztbqqd.out
- %TEMP%\csc73215fbf80964e74a09dea3bfdb7493f.tmp
- %TEMP%\res53e3.tmp
- %TEMP%\tmp5125.tmp
- %WINDIR%\inf\usbhub\usbperfsym.exe
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\temp\aswarpot.bin
- C:\recovery\oem\resetconfig.xml
- C:\recovery\oem\f72eab01-9274-4fa8-a1ac-74c6e8aab8eb.bat
- C:\recovery\oem\e6256cee-3d0f-488e-aace-6a96727fd85a.exe
- %TEMP%\xxct14qt.sxc.bat
- nul
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\tmp138e.tmp.exe.log
- %WINDIR%\temp\tmpe70b.tmp
- %WINDIR%\temp\tmpe7f6.tmp
- %TEMP%\tmp2e0.tmp
- %TEMP%\tmp320.tmp
- %TEMP%\sotka.exe
- %ProgramFiles(x86)%\windows mail\sihost.exe
- %LOCALAPPDATA%\programs\wininit.exe
- %ProgramFiles(x86)%\steam\runtimebroker.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %WINDIR%\inf\.netframework\corperfmonsymbols.exe
- %WINDIR%\inf\usbhub\usbperfsym.exe
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %WINDIR%\media\msldriver.dll
Deletes following files that it created itself
- %TEMP%\res4fad.tmp
- %TEMP%\csc41f1f867ff434a3d8d6c3e394b1389a.tmp
- %TEMP%\wqtv5b4q\wqtv5b4q.cmdline
- %TEMP%\wqtv5b4q\wqtv5b4q.0.cs
- %TEMP%\wqtv5b4q\wqtv5b4q.out
- %TEMP%\tmp49c1.tmp
- %TEMP%\res53e3.tmp
- %TEMP%\csc73215fbf80964e74a09dea3bfdb7493f.tmp
- %TEMP%\bkztbqqd\bkztbqqd.0.cs
- %TEMP%\bkztbqqd\bkztbqqd.cmdline
- %TEMP%\bkztbqqd\bkztbqqd.out
- %TEMP%\tmp5125.tmp
- %WINDIR%\temp\tmpe70b.tmp
- %WINDIR%\temp\tmpe7f6.tmp
- %TEMP%\tmp2e0.tmp
- %TEMP%\tmp320.tmp
Network activity
Connects to
- 'vv#######nj25i5.3utilities.com':443
- 'vv#######nj25i5.ddnsking.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'vv#######nj25i5.3utilities.com':443
- 'vv#######nj25i5.ddnsking.com':443
UDP
- DNS ASK 8j######wi6ns92.webhop.me
- DNS ASK 2y####fuht8iqlo.top
- DNS ASK vv######gyuigi2.hopto.org
- DNS ASK vv######jnj25i5.gotdns.ch
- DNS ASK kq#######tph2l9.bounceme.net
- DNS ASK 29#######l2h4tv.bounceme.net
- DNS ASK 0a########wkq21.freedynamicdns.org
- DNS ASK kq######qtph2l9.hopto.org
- DNS ASK 91#######qtphj2.bounceme.net
- DNS ASK ty######ht82qlo.gotdns.ch
- DNS ASK 0a#######twkq21.ddnsking.com
- DNS ASK 29#######t9ih4v.3utilities.com
- DNS ASK 2n####9uqywio91.top
- DNS ASK 2y####fskfl2qlo.cc
- DNS ASK vq######nzqtqe1.gotdns.ch
- DNS ASK 2n######k4l2o91.hopto.org
- DNS ASK q9#######t9qh4v.3utilities.com
- DNS ASK 0a######jtwkq21.myftp.org
- DNS ASK vv####u9oij25i4.top
- DNS ASK xq######qtwe81v.myftp.org
- DNS ASK q9######qt9qh4v.hopto.org
- DNS ASK ww######gyui3s1.webhop.me
- DNS ASK mq####j29dlqt91.cc
- DNS ASK vv#######yuigi2.3utilities.com
- DNS ASK 2n######k4l2o91.webhop.me
- DNS ASK 3w######htyeqow.webhop.me
- DNS ASK kq######qtph2l9.webhop.me
- DNS ASK vv######jnj25i5.myftp.org
- DNS ASK vv#######ij25i4.bounceme.net
- DNS ASK 2n#######4l2o91.3utilities.com
- DNS ASK 3w####2qhtyeqow.top
- DNS ASK 2y#######t8iqlo.bounceme.net
- DNS ASK 91######nqtphj2.hopto.org
- DNS ASK 2n####9sk4l2o91.top
- DNS ASK 7x####lqtn5sjr3.cc
- DNS ASK 29######qt9ih4v.webhop.me
- DNS ASK 2y######ht8iqlo.webhop.me
- DNS ASK 8j####glwi6ns92.top
- DNS ASK ww######gyui3s1.hopto.org
- DNS ASK 7n########weo91.freedynamicdns.org
- DNS ASK kq########ph2l9.freedynamicdns.org
- DNS ASK 2y#######t8iqlo.3utilities.com
- DNS ASK ty########82qlo.freedynamicdns.org
- DNS ASK 91####fjnqtphj2.top
- DNS ASK 2y####fskfl2qlo.top
- DNS ASK 2y#######fl2qlo.3utilities.com
- DNS ASK vv######gyuigi2.gotdns.ch
- DNS ASK 2y#######fl2qlo.ddnsking.com
- DNS ASK xq######qtwe81v.hopto.org
- DNS ASK 2q######kf22qe1.gotdns.ch
- DNS ASK ty#######t82qlo.ddnsking.com
- DNS ASK 29######el2h4tv.hopto.org
- DNS ASK 8j#######i6ns92.bounceme.net
- DNS ASK 2y######ht8iqlo.myftp.org
- DNS ASK ty######ht82qlo.myftp.org
- DNS ASK 3w#######tyeqow.ddnsking.com
- DNS ASK ww######gyui3s1.gotdns.ch
- DNS ASK ty####fqht82qlo.cc
- DNS ASK 2n#######4l2o91.ddnsking.com
- DNS ASK 2q#######f22qe1.bounceme.net
- DNS ASK 8j########6ns92.freedynamicdns.org
- DNS ASK vq#######zqtqe1.ddnsking.com
- DNS ASK kq#######tph2l9.3utilities.com
- DNS ASK vv#######yuigi2.bounceme.net
- DNS ASK xq########we81v.freedynamicdns.org
- DNS ASK 7x######tn5sjr3.hopto.org
- DNS ASK q9####jfqt9qh4v.top
- DNS ASK 2y######kfl2qlo.myftp.org
- DNS ASK q9########9qh4v.freedynamicdns.org
- DNS ASK 8j#######i6ns92.3utilities.com
- DNS ASK vv########j25i4.freedynamicdns.org
- DNS ASK 7n######qyweo91.webhop.me
- DNS ASK 29#######t9ih4v.bounceme.net
- DNS ASK vv#######nj25i5.3utilities.com
- DNS ASK vv#######ij25i4.3utilities.com
- DNS ASK kq######qtph2l9.gotdns.ch
- DNS ASK ww#######yui3s1.bounceme.net
- DNS ASK vv######oij25i4.myftp.org
- DNS ASK 29#######l2h4tv.ddnsking.com
- DNS ASK ty######ht82qlo.hopto.org
- DNS ASK 91########tphj2.freedynamicdns.org
- DNS ASK 3w######htyeqow.gotdns.ch
- DNS ASK vv########uigi2.freedynamicdns.org
- DNS ASK 2n#######ywio91.bounceme.net
- DNS ASK vq#######zqtqe1.bounceme.net
- DNS ASK xq######qtwe81v.gotdns.ch
- DNS ASK vv#######nj25i5.ddnsking.com
- DNS ASK x1.#.lencr.org
- DNS ASK vv######jnj25i5.webhop.me
- DNS ASK 29####jsel2h4tv.cc
- DNS ASK vq####fqnzqtqe1.cc
- DNS ASK ww#######yui3s1.3utilities.com
- DNS ASK 8j####glwi6ns92.cc
- DNS ASK 2q######kf22qe1.myftp.org
- DNS ASK 0a#######twkq21.bounceme.net
- DNS ASK dn#.google
- 'dn#.google':443
- '18#.#14.97.1':443
Miscellaneous
Searches for the following windows
- ClassName: 'MouseZ' WindowName: 'Magellan MSWHEEL'
Creates and executes the following
- '%TEMP%\tmp138e.tmp.exe'
- '%WINDIR%\syswow64\systemdiagnosticshost.exe'
- '%WINDIR%\media\mppr.exe'
- '%TEMP%\sotka.exe'
- '%ProgramFiles(x86)%\steam\runtimebroker.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wqtv5b4q\wqtv5b4q.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4FAD.tmp" "%TEMP%\CSC41F1F867FF434A3D8D6C3E394B1389A.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bkztbqqd\bkztbqqd.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES53E3.tmp" "%TEMP%\CSC73215FBF80964E74A09DEA3BFDB7493F.TMP"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon & exit
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe"
- '<SYSTEM32>\cmd.exe' /c sc query "System Diagnostics Host" & exit
- '<SYSTEM32>\sc.exe' query "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
- '<SYSTEM32>\sc.exe' create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
- '<SYSTEM32>\sc.exe' description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit
- '<SYSTEM32>\sc.exe' start "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name="XCCProcess" & exit
- '<SYSTEM32>\netsh.exe' advfirewall firewall show rule name="XCCProcess"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c sc.exe create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel & exit
- '<SYSTEM32>\sc.exe' create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel
- '<SYSTEM32>\cmd.exe' /c sc.exe start aswArPot.sys & exit
- '<SYSTEM32>\sc.exe' start aswArPot.sys
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\xxct14qt.sxc.bat""
- '<SYSTEM32>\timeout.exe' 8
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
- '<SYSTEM32>\securityhealthservice.exe'
- '%WINDIR%\syswow64\reagentc.exe' /disable
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wqtv5b4q\wqtv5b4q.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4FAD.tmp" "%TEMP%\CSC41F1F867FF434A3D8D6C3E394B1389A.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\bkztbqqd\bkztbqqd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES53E3.tmp" "%TEMP%\CSC73215FBF80964E74A09DEA3BFDB7493F.TMP"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\runtimebroker.exe' -' (with hidden window)
