Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\auagent
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1215060] 'ImagePath' = 'cmd /c move %WINDIR%\temp\1214686 C:\mpclient.exe'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1217151] 'ImagePath' = 'cmd /c move %WINDIR%\temp\1214779 C:\mpclient.dll'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1218009] 'ImagePath' = 'cmd /c move %WINDIR%\temp\1214888 C:\mpclient.dat'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1219179] 'ImagePath' = 'C:\mpclient.exe'
Creates the following services
- 'CreateSvcRpc_1215060' cmd /c move %WINDIR%\temp\1214686 C:\mpclient.exe
- 'CreateSvcRpc_1217151' cmd /c move %WINDIR%\temp\1214779 C:\mpclient.dll
- 'CreateSvcRpc_1218009' cmd /c move %WINDIR%\temp\1214888 C:\mpclient.dat
- 'CreateSvcRpc_1219179' C:\mpclient.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\1214686
- %WINDIR%\temp\1214779
- %WINDIR%\temp\1214888
Moves the following files
- from %WINDIR%\temp\1214686 to C:\mpclient.exe
- from %WINDIR%\temp\1214779 to C:\mpclient.dll
- from %WINDIR%\temp\1214888 to C:\mpclient.dat
- from C:\mpclient.exe to <SYSTEM32>\mpclient.exe
- from C:\mpclient.dll to <SYSTEM32>\mpclient.dll
- from C:\mpclient.dat to <SYSTEM32>\mpclient.dat
Network activity
Connects to
- '18.##7.223.205':8080
- '18.##7.223.205':80
TCP
HTTP GET requests
- http://18.##7.223.205/
UDP
- 'localhost':54126
Miscellaneous
Creates and executes the following
- 'C:\mpclient.exe'
- '<SYSTEM32>\mpclient.exe' -svc
Executes the following
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\1214686 C:\mpclient.exe
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\1214779 C:\mpclient.dll
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\1214888 C:\mpclient.dat
- '<SYSTEM32>\svchost.exe' -Install
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -Install' (with hidden window)
- '<SYSTEM32>\mpclient.exe' -svc' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)
