Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DCOM Server Process Service Launcher] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NET Runtime Process Update Launcher] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\javalogs\tempblogs.\tempblogs..\winlogones.exe'
- '<SYSTEM32>\javalogs\tempblogs.\tempblogs..\winlogones.exe' (downloaded from the Internet)
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://11#.#11.111.1/book/index.html
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\javalogs\tempblogs.\tempblogs..\ChilkatCert.dll
- '<SYSTEM32>\calc.exe'
Injects code into
the following system processes:
- <SYSTEM32>\calc.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\count[1].txt
- <SYSTEM32>\javalogs\tempblogs.\tempblogs..\iexplores.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index[1].html
- <SYSTEM32>\javalogs\tempblogs.\tempblogs..\count.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\cert[1].pdf
- <SYSTEM32>\javalogs\tempblogs.\tempblogs..\winlogones.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\java[1].pdf
- <SYSTEM32>\javalogs\tempblogs.\tempblogs..\ChilkatCert.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\dll[1].pdf
Network activity:
Connects to:
- 'localhost':1040
- 'www.kr###gam.com':80
- 'localhost':1038
TCP:
HTTP GET requests:
- www.kr###gam.com/book/count.txt
- www.kr###gam.com/book/index.html
- www.kr###gam.com/temp/cert.pdf
- www.kr###gam.com/book/java.pdf
- www.kr###gam.com/book/dll.pdf
UDP:
- DNS ASK ke###dmin.com
- DNS ASK www.kr###gam.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ComboBoxEx32' WindowName: '(null)'
- ClassName: 'ComboBox' WindowName: '(null)'
- ClassName: '#32770' WindowName: 'WINLOGON.EXE'
- ClassName: '#32770' WindowName: 'Windows - ?????? ????'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'WinProServicePack002' WindowName: 'The WinProServicePack002'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '#32770' WindowName: 'CALC.EXE'
- ClassName: '' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'WinIEServicePack001' WindowName: 'The WinIEServicePack001'
- ClassName: 'Chrome_WidgetWin_1' WindowName: '(null)'
- ClassName: 'Address Band Root' WindowName: '(null)'
- ClassName: 'Edit' WindowName: '(null)'
- ClassName: 'WorkerW' WindowName: '(null)'
- ClassName: 'ReBarWindow32' WindowName: '(null)'
