Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\cwlxgdc.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Network activity
TCP
HTTP GET requests
- http://dl#.#oxi.net/drive/2018/11/12/0027/3642/1777210/10/7f00c6173d.txt
UDP
- DNS ASK dl#.#oxi.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' copy-item -path '<Full path to file>' -destination '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cwlXGDC.exe'' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' copy-item -path '<Full path to file>' -destination '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cwlXGDC.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
