Technical Information
Malicious functions:
Creates and executes the following:
- C:\mmpmegx.exe (downloaded from the Internet)
- C:\uhjb.exe (downloaded from the Internet)
- C:\cclx.exe (downloaded from the Internet)
- C:\bktdl.exe (downloaded from the Internet)
- C:\vefuq.exe (downloaded from the Internet)
- C:\baif.exe (downloaded from the Internet)
- C:\ryxy.exe (downloaded from the Internet)
- C:\750234914 (downloaded from the Internet)
- %TEMP%\nsx3.tmp\EP.exe
- %TEMP%\nsx3.tmp\e4u.exe
- %TEMP%\nsx3.tmp\setup.exe
- %TEMP%\nsx3.tmp\Games.exe
- C:\vwhqlwgw.exe (downloaded from the Internet)
- C:\ofgitsly.exe (downloaded from the Internet)
- C:\sbvyj.exe (downloaded from the Internet)
- C:\gbfxe.exe (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\spoolsv.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\iouvvfgcd[1].php
- C:\mmpmegx.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\hnkppz[1].php
- C:\uhjb.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\zgzzjjwli[1].php
- C:\cclx.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\wcyijjt[1].php
- C:\bktdl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\ohnbbyyif[1].php
- C:\vefuq.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\bhanx[1].php
- C:\baif.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\wtqanbo[1].php
- C:\ryxy.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\mbhrobl[1].php
- C:\750234914
- <SYSTEM32>\spool\prtprocs\w32x86\4.tmp
- %TEMP%\nsx3.tmp\e4u.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\jqqankx[1].php
- %WINDIR%\Temp\5.tmp
- %TEMP%\nsx3.tmp\setup.exe
- %TEMP%\nsv2.tmp
- %TEMP%\nsx3.tmp\EP.exe
- %TEMP%\nsx3.tmp\Games.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\hohhveswgc[1].php
- C:\vwhqlwgw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\bhrnbylv[1].php
- C:\ofgitsly.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\zfpcdmakt[1].php
- C:\sbvyj.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\irxhiiffp[1].php
- C:\gbfxe.exe
Deletes the following files:
- %WINDIR%\Temp\5.tmp
- <SYSTEM32>\spool\prtprocs\w32x86\4.tmp
- %TEMP%\nsx3.tmp\Games.exe
- %TEMP%\nsx3.tmp\e4u.exe
- %TEMP%\nsx3.tmp\EP.exe
Network activity:
Connects to:
- 'ab###der.com':80
- 'je####ts-center.com':80
TCP:
HTTP GET requests:
- ab###der.com/tdfpmmn/wtqanbo.php?ad########
- ab###der.com/tdfpmmn/hnkppz.php?ad########
- ab###der.com/tdfpmmn/iouvvfgcd.php?ad########
- ab###der.com/tdfpmmn/bhanx.php?ad###############################################
- ab###der.com/tdfpmmn/ohnbbyyif.php?ad########
- ab###der.com/tdfpmmn/mbhrobl.php?ad########
- ab###der.com/tdfpmmn/wcyijjt.php?ad########
- ab###der.com/tdfpmmn/irxhiiffp.php?ad########
- ab###der.com/tdfpmmn/zfpcdmakt.php?ad########
- ab###der.com/tdfpmmn/jqqankx.php?ad########
- ab###der.com/tdfpmmn/zgzzjjwli.php?ad########
- ab###der.com/tdfpmmn/bhrnbylv.php?ad########
- ab###der.com/tdfpmmn/hohhveswgc.php?ad########
HTTP POST requests:
- je####ts-center.com/view.php?da###############################################################################################################
UDP:
- DNS ASK ab###der.com
- DNS ASK je####ts-center.com
- '<Private IP address>':1034
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
