Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\update\hwgugq
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\svt.exe" "svt.exe" ENABLE
Injects code into
the following user processes:
- lomkjwq.exe
Modifies file system
Creates the following files
- %TEMP%\lomkjwq.exe
- %TEMP%\a88888.xml
- %TEMP%\core.exe
- %TEMP%\ahhhhh.xml
- %TEMP%\naruto-sennin_2gjj.png
- %TEMP%\svt.exe
- %TEMP%\aqqqqq.xml
- %TEMP%\awwwww.xml
- %TEMP%\ayyyyy.xml
- %TEMP%\aeeeee.xml
- %TEMP%\a99999.xml
- %TEMP%\a77777.xml
- %TEMP%\akkkkk.xml
- %TEMP%\azzzzz.xml
- %TEMP%\asssss.xml
- %TEMP%\alllll.xml
Deletes the following files
- %TEMP%\a88888.xml
- %TEMP%\aqqqqq.xml
- %TEMP%\ahhhhh.xml
- %TEMP%\awwwww.xml
- %TEMP%\ayyyyy.xml
- %TEMP%\aeeeee.xml
- %TEMP%\a99999.xml
- %TEMP%\a77777.xml
- %TEMP%\akkkkk.xml
- %TEMP%\azzzzz.xml
- %TEMP%\asssss.xml
- %TEMP%\alllll.xml
Substitutes the following files
- %TEMP%\a88888.xml
Network activity
Connects to
- '<LOCALNET>.0.21':1177
UDP
- DNS ASK sv####7.duckdns.org
Miscellaneous
Creates and executes the following
- '%TEMP%\core.exe' -woohoo 2152 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 1924 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 2968 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 148 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 2000 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 2676 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 1376 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 2788 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 1780 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 2804 %TEMP%\LoMkjwQ.exe
- '%TEMP%\core.exe' -woohoo 1768 %TEMP%\LoMkjwQ.exe
- '%TEMP%\lomkjwq.exe'
- '%TEMP%\svt.exe'
- '%TEMP%\core.exe' -woohoo 260 %TEMP%\LoMkjwQ.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\awwwww.xm#"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\ayyyyy.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aLLLLL.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aSSSSS.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\azzzzz.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a77777.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aqqqqq.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a99999.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aeeeee.xml"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\svt.exe" "svt.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aKKKKK.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aHHHHH.xml"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a88888.xml"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a88888.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aHHHHH.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aqqqqq.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\awwwww.xm#"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\ayyyyy.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aeeeee.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a99999.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a77777.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aKKKKK.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\azzzzz.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aSSSSS.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aLLLLL.xml"
