Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\xdwdSysHostHelper.exe,'
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %WINDIR%\xdwdSysHostHelper.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\winsecuritymonitor
- <SYSTEM32>\tasks\winsecuritymonitor_repeat
Creates the following files on removable media
- <Drive name for removable media>:\nettelemetrybroker.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue"
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="%WINDIR%\xdwdSysHostHelper.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsControl" dir=out action=allow program="%WINDIR%\xdwdSysHostHelper.exe" enable=yes
Hooks functions
in browsers
- iexplore.exe process, iphlpapi.dll module
- firefox.exe process, iphlpapi.dll module
Patches code
in dll
- xdwdsyshosthelper.exe process, IPHLPAPI.DLL module
in NTDLL dll
- xdwdsyshosthelper.exe process, ntdll.dll module
- powershell.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %WINDIR%\xdwdsyshosthelper.exe
- %WINDIR%\xdwd.dll
- %ProgramFiles%\xdwdtaskhostw.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\xdwd.dll
- %WINDIR%\xdwdsyshosthelper.exe
- %ProgramFiles%\xdwdtaskhostw.exe
Deletes following files that it created itself
- %WINDIR%\xdwd.dll
Moves the following files
- from %WINDIR%\xdwd.dll to %WINDIR%\xdwd.dll.8998d1f5.old
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ic###azip.com':443
- 'ip##fo.io':443
- 'x1.#.lencr.org':80
- 'wi#####ks.duckdns.org':9469
- 'vv#####91.duckdns.org':9469
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ap#.#pify.org':443
- 'ic###azip.com':443
- 'ip##fo.io':443
- 'cr#####nana.duckdns.org':9469
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ic###azip.com
- DNS ASK ip##fo.io
- DNS ASK x1.#.lencr.org
- DNS ASK wi#####ks.duckdns.org
- DNS ASK vv#####91.duckdns.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\xdwdsyshosthelper.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "WinSecurityMonitor" /tr "\"%WINDIR%\xdwdSysHostHelper.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WinSecurityMonitor_repeat" /tr "\"%WINDIR%\xdwdSysHostHelper.exe\"" /sc minute /mo 1 /rl highest /f
- '<SYSTEM32>\schtasks.exe' /run /tn "WinSecurityMonitor"
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '<SYSTEM32>\sc.exe' create "WinSecurityUpdate" binPath= "\"%WINDIR%\xdwdSysHostHelper.exe\"" start= auto
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsUpdateTask" /tr "\"%ProgramFiles%\xdwdtaskhostw.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsUpdateTask_repeat" /tr "\"%ProgramFiles%\xdwdtaskhostw.exe\"" /sc minute /mo 30 /rl highest /f
