Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc64
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\OGLWNWUI] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\OGLWNWUI] 'ImagePath' = '%ALLUSERSPROFILE%\rasnaebnnzdh\ywsmbklbxkln.exe'
Creates the following services
- 'OGLWNWUI' %ALLUSERSPROFILE%\rasnaebnnzdh\ywsmbklbxkln.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\sppextcomobj.exe
- <SYSTEM32>\slui.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\wbem\wmiprvse.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\rasnaebnnzdh\ywsmbklbxkln.exe
- %WINDIR%\temp\__psscriptpolicytest_r2qaa4ir.aih.ps1
- %WINDIR%\temp\__psscriptpolicytest_g4mhbbeg.ffr.psm1
- %WINDIR%\temp\__psscriptpolicytest_rbwfknus.ofg.ps1
- %WINDIR%\temp\__psscriptpolicytest_dsug0w40.i02.psm1
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-37-942.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-38-195.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-273.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-406.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-624.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-38-677.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-688.dump
- %WINDIR%\temp\__psscriptpolicytest_1x5vpyrq.c0d.ps1
- %WINDIR%\temp\__psscriptpolicytest_5gsjjlcy.gki.psm1
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-929.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-38-967.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-38-999.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-39-046.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-39-083.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-39-295.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-39-520.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-39-605.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-41-751.dump
- %WINDIR%\temp\content\6004-6136-powershell.exe-12-39-41-861.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-035.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-089.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-133.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-175.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-218.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-260.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-303.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-42-924.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-035.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-156.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-201.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-295.dump
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-356.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\content\6116-5808-powershell.exe-12-39-43-433.dump
- %WINDIR%\temp\cciqcanloesi.sys
- %WINDIR%\temp\__psscriptpolicytest_0tc5pbqb.pns.ps1
- %WINDIR%\temp\__psscriptpolicytest_qptkbqcd.ar2.psm1
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-119.dump
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-431.dump
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-685.dump
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-746.dump
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-885.dump
- %WINDIR%\temp\content\4888-5384-powershell.exe-12-39-48-979.dump
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_r2qaa4ir.aih.ps1
- %WINDIR%\temp\__psscriptpolicytest_g4mhbbeg.ffr.psm1
- %WINDIR%\temp\__psscriptpolicytest_rbwfknus.ofg.ps1
- %WINDIR%\temp\__psscriptpolicytest_dsug0w40.i02.psm1
- %WINDIR%\temp\__psscriptpolicytest_1x5vpyrq.c0d.ps1
- %WINDIR%\temp\__psscriptpolicytest_5gsjjlcy.gki.psm1
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\temp\__psscriptpolicytest_0tc5pbqb.pns.ps1
- %WINDIR%\temp\__psscriptpolicytest_qptkbqcd.ar2.psm1
Network activity
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK pa###bin.com
- DNS ASK fi#####.###tings.services.mozilla.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\rasnaebnnzdh\ywsmbklbxkln.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "OGLWNWUI"
- '<SYSTEM32>\sc.exe' create "OGLWNWUI" binpath= "%ALLUSERSPROFILE%\rasnaebnnzdh\ywsmbklbxkln.exe" start= "auto"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "OGLWNWUI"
- '<SYSTEM32>\dllhost.exe' /Processid:{bce129d1-ca04-42df-b69b-e55968b097e0}
- '<SYSTEM32>\dllhost.exe' /Processid:{31cffd19-45df-4757-8bbd-3b677bbc2202}
