Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'apiMgIME' = 'rundll32 "%APPDATA%\Microsoft\Acle3d10\d3dx0_33.dll",DllRegisterServer'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\rundll32.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, wininet.dll module
- iexplore.exe process, urlmon.dll module
- iexplore.exe process, advapi32.dll module
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
- iexplore.exe process, mshtml.dll module
- firefox.exe process, urlmon.dll module
- firefox.exe process, advapi32.dll module
Modifies file system
Creates the following files
- mailslot\sla18
- %APPDATA%\microsoft\acle3d10\d3dx0_33.dll
Deletes itself.
Network activity
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?' (with hidden window)
Executes the following
- '<SYSTEM32>\control.exe' /?
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\9F01.bi1"
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\75A3.bi1"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
