Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\centurylinkinstallersetup.exe
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is6570.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def6560.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr654f.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str654e.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isb653e.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\dot653d.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\cor652c.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif652b.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon652a.tmp
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set6519.tmp
- %TEMP%\64da.tmp
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\0x0409.ini
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\setup.ini
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\setup.iss
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\setup.inx
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\setup.ini
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\setup.exe
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\md5sum.exe
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\license.rtf
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\layout.bin
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\issetup.dll
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\data1.hdr
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\data1.cab
- %TEMP%\{74d55b2c-f26a-4711-b946-a25cfc5d1975}\disk1\0x0409.ini
- %TEMP%\rarsfx0\config.ini
- %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is6581.tmp
- %WINDIR%\centurylinkinstallersetup.log
Moves the following files
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set6519.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon652a.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif652b.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\cor652c.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\corecomp.ini
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\dot653d.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\dotnetinstaller.exe
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isb653e.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str654e.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr654f.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def6560.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is6570.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
- from %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is6581.tmp to %TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{322F5005-8D51-4E8D-B52F-4D4903255518}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{759D705E-2419-480D-9A05-B673BC5208B4}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{34AFB225-13EB-4663-BB6E-6DE245DEE6B4}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9ED87DDB-1D35-4336-BBEB-0CEBC4F1A7EA}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE124038-D091-4AD5-8AAB-5E8CEE635850}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03441D7C-2883-44F4-B90F-4A44E530618B}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC7D0899-5CF6-471C-B1C4-8556ACEA0C34}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AAB4FEF-A870-4ED0-BA5D-2FA2A6BBFCA0}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4293433C-0721-40FA-891A-3B1D59C09FAC}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CD66E45-B993-47AB-B2C6-9FDEBD1A0585}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB18AB1A-7741-4514-AAEA-F4F7BBB534EB}
- '%TEMP%\{bc78d7f4-75fa-4567-9838-9dd4b1fffb68}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5544DC3A-BB4F-4BC2-AD42-054241D219E3}
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (with hidden window)
