Technical Information
Malicious functions
Patches code
in dll
- zyvyb.exe process, KERNEL32.dll module
- zyvyb.exe process, KERNELBASE.dll module
- zyvyb.exe process, ADVAPI32.dll module
- zyvyb.exe process, USER32.dll module
- 1q3zqx56.exe process, KERNEL32.dll module
- 1q3zqx56.exe process, KERNELBASE.dll module
- 1q3zqx56.exe process, ADVAPI32.dll module
- 1q3zqx56.exe process, USER32.dll module
in NTDLL dll
- zyvyb.exe process, ntdll.dll module
- 1q3zqx56.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\1q3zqx56.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
Deletes itself.
Network activity
Connects to
- 'microsoft.com':443
TCP
Other
- 'microsoft.com':443
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<Current directory>\1q3zqx56.exe' "--cleanup" "<Full path to file>"
