Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\rundll32.exe
Modifies file system
Creates the following files
- %TEMP%\~983022.tmp
- %TEMP%\bm41b1.tmp
Deletes the following files
- %TEMP%\~983022.tmp
Network activity
Connects to
- 'jp##.co.kr':80
TCP
HTTP GET requests
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_0_started_ext_ALRRR_N_OSBBB_64_OSNNN_Windows_7_...
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_23_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_24_process_spoolsv.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_25_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_26_process_taskhost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_27_process_dwm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_28_process_explorer.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_21_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_22_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_29_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_32_process_iexplore.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_33_process_firefox.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_34_process_iexplore.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_35_process_WmiPrvSE.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_36_process_audiodg.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_37_process_rundll32.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_30_process_mdm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_31_process_WUDFHost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_20_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_19_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_18_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_2_step_1
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_3_already_ok
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_4_mark_ok
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_5_process__System_Process_
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_4_watch2_start_1100_473
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_7_process_System
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_8_process_smss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_1_step_0
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_8_watch2_finish_1003_510__1
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_11_process_wininit.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_12_process_csrss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_13_process_winlogon.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_14_process_services.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_15_process_lsass.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_16_process_lsm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_17_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_9_process_csrss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_38_process_jdsulhb.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_71656373756573696F_75736572_BB7153C8_90032C57_39_step_2
UDP
- DNS ASK jp##.co.kr
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' shell32.dll,Control_RunDLL
