Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\cp8lbent
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\wmiApSrv] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\CP8LbeNT] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\CP8LbeNT] 'ImagePath' = 'cmd /c cd /d "%ProgramFiles(x86)%\gloand-r\ijaootttx\" && start "" "%ProgramFiles(x86)%\gloand-r\ijaootttx\CP8LbeNT.exe"'
Creates the following services
- 'CP8LbeNT' cmd /c cd /d "%ProgramFiles(x86)%\gloand-r\ijaootttx\" && start "" "%ProgramFiles(x86)%\gloand-r\ijaootttx\CP8LbeNT.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force
Modifies file system
Creates the following files
- %TEMP%\is-etcm2.tmp\<File name>.tmp
- %TEMP%\is-60e9i.tmp\_isetup\_setup64.tmp
- %TEMP%\is-60e9i.tmp\_isetup\_shfoldr.dll
- %ProgramFiles(x86)%\gloand-r\ijaootttx\is-7kb60.tmp
- %ProgramFiles(x86)%\gloand-r\ijaootttx\is-kumld.tmp
- %ProgramFiles(x86)%\gloand-r\ijaootttx\is-1tv8l.tmp
- %ProgramFiles(x86)%\gloand-r\ijaootttx\udxaeet
- <SYSTEM32>\bzwjnbi
- %WINDIR%\uakzocco.bat
- %WINDIR%\temp\__psscriptpolicytest_lvcw42jv.0vi.ps1
- %WINDIR%\temp\__psscriptpolicytest_spmnytjj.iwd.psm1
- %WINDIR%\temp\__psscriptpolicytest_zy31jsap.bi5.ps1
- %WINDIR%\temp\__psscriptpolicytest_vulyqczl.1qt.psm1
- nul
- <SYSTEM32>\wkcplew
- %ALLUSERSPROFILE%\8ef8be8000002b9b\regedit.log
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
Deletes following files that it created itself
- %TEMP%\is-60e9i.tmp\_isetup\_setup64.tmp
- %TEMP%\is-60e9i.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-etcm2.tmp\<File name>.tmp
- %WINDIR%\temp\__psscriptpolicytest_lvcw42jv.0vi.ps1
- %WINDIR%\temp\__psscriptpolicytest_spmnytjj.iwd.psm1
- %WINDIR%\temp\__psscriptpolicytest_zy31jsap.bi5.ps1
- %WINDIR%\temp\__psscriptpolicytest_vulyqczl.1qt.psm1
Moves the following files
- from %ProgramFiles(x86)%\gloand-r\ijaootttx\is-7kb60.tmp to %ProgramFiles(x86)%\gloand-r\ijaootttx\2ho5s.wp
- from %ProgramFiles(x86)%\gloand-r\ijaootttx\is-kumld.tmp to %ProgramFiles(x86)%\gloand-r\ijaootttx\cp8lbent.exe
- from %ProgramFiles(x86)%\gloand-r\ijaootttx\is-1tv8l.tmp to %ProgramFiles(x86)%\gloand-r\ijaootttx\vcp7jdw8.t
Network activity
Connects to
- '14#.#2.43.162':7137
TCP
Other
- '14#.#2.43.162':7137
Miscellaneous
Searches for the following windows
- ClassName: 'Q360SafeMonClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-etcm2.tmp\<File name>.tmp' /SL5="$1C01CA,7629141,389120,<Full path to file>"
- '%ProgramFiles(x86)%\gloand-r\ijaootttx\cp8lbent.exe'
Executes the following
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '<SYSTEM32>\cmd.exe' /c "%WINDIR%\uAkzoCcO.bat"
- '<SYSTEM32>\systemsettingsbroker.exe'
- '<SYSTEM32>\tasklist.exe' /fi "PID eq 636"
- '<SYSTEM32>\findstr.exe' /i "636"
- '<SYSTEM32>\timeout.exe' /t 15
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force' (with hidden window)
