Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\-1998166001'
- '%TEMP%\lwhkglx.exe'
- '%TEMP%\kwlfpgbp.exe'
- '%TEMP%\erwrqmr.exe'
- '%TEMP%\xlms.exe'
- '%TEMP%\pgow.exe'
- '%TEMP%\tavhfp.exe'
- '%TEMP%\mnher.exe'
- '%TEMP%\rqtnyev.exe'
- '%TEMP%\jbisde.exe'
- '%TEMP%\ltjbfnex.exe'
- '%TEMP%\lsctgcbm.exe'
- '%TEMP%\mnher.exe' (downloaded from the Internet)
- '%TEMP%\erwrqmr.exe' (downloaded from the Internet)
- '%TEMP%\kwlfpgbp.exe' (downloaded from the Internet)
- '%TEMP%\xlms.exe' (downloaded from the Internet)
- '%TEMP%\ltjbfnex.exe' (downloaded from the Internet)
- '%TEMP%\lsctgcbm.exe' (downloaded from the Internet)
- '%TEMP%\jbisde.exe' (downloaded from the Internet)
- '%TEMP%\rqtnyev.exe' (downloaded from the Internet)
- '%TEMP%\tavhfp.exe' (downloaded from the Internet)
- '%TEMP%\pgow.exe' (downloaded from the Internet)
- '%TEMP%\lwhkglx.exe' (downloaded from the Internet)
- '%TEMP%\-1998166001' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c del <SYSTEM32>\svchost.exe > nul
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\Explorer.EXE
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xavdxsz[1].php
- %TEMP%\xlms.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\qhlkrzhf[1].php
- %TEMP%\pgow.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\xbvqxsa[1].php
- %TEMP%\tavhfp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\sjnlgn[1].php
- %TEMP%\mnher.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zptfzubjhp[1].php
- %TEMP%\erwrqmr.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\izgowq[1].php
- %TEMP%\kwlfpgbp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tyfnhc[1].php
- %TEMP%\rqtnyev.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\kbwdyfeyta[1].php
- %TEMP%\ltjbfnex.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hyfaitavt[1].php
- %TEMP%\jbisde.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mmaucwe[1].php
- %TEMP%\lwhkglx.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ultamgbih[1].php
- %TEMP%\-1998166001
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\cptrlg[1].php
- %TEMP%\lsctgcbm.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iztbjhowu[1].php
Deletes the following files:
- <SYSTEM32>\svchost.exe
Deletes itself.
Network activity:
Connects to:
- 'aa###ute.com':80
TCP:
HTTP GET requests:
- http://aa###ute.com/timuo/qhlkrzhf.php?ad########
- http://aa###ute.com/timuo/xavdxsz.php?ad########
- http://aa###ute.com/timuo/xbvqxsa.php?ad########
- http://aa###ute.com/timuo/zptfzubjhp.php?ad#####################################################
- http://aa###ute.com/timuo/sjnlgn.php?ad########
- http://aa###ute.com/timuo/izgowq.php?ad########
- http://aa###ute.com/timuo/tyfnhc.php?ad########
- http://aa###ute.com/timuo/kbwdyfeyta.php?ad########
- http://aa###ute.com/timuo/hyfaitavt.php?ad########
- http://aa###ute.com/timuo/mmaucwe.php?ad########
- http://aa###ute.com/timuo/ultamgbih.php?ad########
- http://aa###ute.com/timuo/iztbjhowu.php?ad########
- http://aa###ute.com/timuo/cptrlg.php?ad########
UDP:
- DNS ASK aa###ute.com
