Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'rpebuwkebq' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\nsqB8A6.tmp.dll"'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'rpebuwkebq' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\citywdtlpihxt.dll"'
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\nsab0a9.tmp\system.dll
- %TEMP%\nsqb8a6.tmp.dll
- %WINDIR%\syswow64\futwchyrwbshm.exe
Deletes the following files
- %TEMP%\nsab0a9.tmp\system.dll
Moves the following files
- from %TEMP%\nsqb8a6.tmp.dll to %WINDIR%\syswow64\citywdtlpihxt.dll
Network activity
Connects to
- 'google.com':80
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK cr#####eadnetwork.net
- DNS ASK cx.#####iveadnetwork.net
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\citywdtlpihxt.dll"
