Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\--] 'ImagePath' = '<Full path to file> /wl 1'
- [HKLM\System\CurrentControlSet\Services\ZTZjYzE0ZGFhMGJlNGM] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ZTZjYzE0ZGFhMGJlNGM] 'ImagePath' = 'rundll32.exe %WINDIR%\qdjopjioxyusqfbarfc.qdjo CsxTBUtnspzAYmQakbgq'
- [HKLM\System\CurrentControlSet\Services\OTU0ODhkYjgwND] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\OTU0ODhkYjgwND] 'ImagePath' = '<DRIVERS>\OTU0ODhkYjgwND'
- [HKLM\System\CurrentControlSet\Services\NDNlMjc4M] 'ImagePath' = '"%ProgramFiles%\NDNlMjc4M\NmFkZjk5YWV.exe"'
- [HKLM\System\CurrentControlSet\Services\NDNlMjc4M] 'Start' = '00000002'
Creates the following services
- '--' <Full path to file> /wl 1
- 'ZTZjYzE0ZGFhMGJlNGM' rundll32.exe %WINDIR%\qdjopjioxyusqfbarfc.qdjo CsxTBUtnspzAYmQakbgq
- 'OTU0ODhkYjgwND' <DRIVERS>\OTU0ODhkYjgwND
- 'NDNlMjc4M' "%ProgramFiles%\NDNlMjc4M\NmFkZjk5YWV.exe"
- 'NDNlMjc4M' %ProgramFiles%\NDNlMjc4M\NmFkZjk5YWV.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\uninstaller.dat' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\ZDY5YjE3MmJjNmM5OD.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\OTU0ODhkYjgwND' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\NDNlMjc4M' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\ndnlmjc4m\' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\OTU0ODhkYjgwND.sys' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\ZDY5YjE3MmJjNmM5OD' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\nsj8a36.tmp\othgyzrvmap.dll
- %ProgramFiles%\ndnlmjc4m\nspr4.dll
- %ProgramFiles%\ndnlmjc4m\plc4.dll
- %ProgramFiles%\ndnlmjc4m\plds4.dll
- %ProgramFiles%\ndnlmjc4m\softokn3.dll
- %ProgramFiles%\ndnlmjc4m\mozcrt19.dll
- <DRIVERS>\otu0odhkyjgwnd
- %WINDIR%\syswow64\ssl\cert.db
- %WINDIR%\syswow64\ssl\mdhkz 2.cer
- ctrlsmotu0odhkyjgwnd
- %ProgramFiles%\mozilla firefox\defaults\pref\secure_cert.js
- %WINDIR%\temp\wjm52e0.tmp
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\secmod.db
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\cert8.db
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\key3.db
- %ProgramFiles%\ndnlmjc4m\zdy5yje3mmjjnmm5od.exe
- %WINDIR%\zdy5yje3mmjjnmm5od.exe
- %ProgramFiles%\ndnlmjc4m\wbe_uninstall.dat
- %WINDIR%\uninstaller.dat
- %TEMP%\a662.tmp
- %TEMP%\a674.tmp
- %TEMP%\a674.tmp-shm
- %TEMP%\a904.tmp
- %TEMP%\a906.tmp
- %TEMP%\a906.tmp-shm
- %TEMP%\nsjab67.tmp
- %ProgramFiles%\ndnlmjc4m\nss3.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %ProgramFiles%\ndnlmjc4m\ntnmzwvhot
- %WINDIR%\qdjopjioxyusqfbarfc.qdjo
- %TEMP%\nsj8a36.tmp\qqkrqtulk
- %TEMP%\nsj8a36.tmp\qfpjcpozttg.dll
- %TEMP%\nsj988a.tmp
- %TEMP%\nsy989a.tmp\system.dll
- %TEMP%\nsy989a.tmp\ipconfig.dll
- %TEMP%\nsy989a.tmp\md5dll.dll
- %TEMP%\nsy989a.tmp\simplesc.dll
- %TEMP%\nsy989a.tmp\nsiscrypt.dll
- %TEMP%\nsy989a.tmp\nsexec.dll
- %WINDIR%\temp\nsyafbf.tmp\othgyzrvmap.dll
- %WINDIR%\temp\nsyafbf.tmp\qqkrqtulk
- %WINDIR%\temp\nsyafbf.tmp\qfpjcpozttg.dll
- %WINDIR%\temp\nstb51e.tmp
- %WINDIR%\temp\nstb51f.tmp\system.dll
- %WINDIR%\temp\nstb51f.tmp\ipconfig.dll
- %WINDIR%\temp\nstb51f.tmp\md5dll.dll
- %WINDIR%\temp\nstb51f.tmp\simplesc.dll
- %WINDIR%\temp\nstb51f.tmp\nsiscrypt.dll
- %TEMP%\nsy989a.tmp\inetc.dll
- %TEMP%\nsy989a.tmp\moreinfo.dll
- %TEMP%\nsy989a.tmp\nsislist.dll
- %ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe
- %ProgramFiles%\ndnlmjc4m\service_64.dat
- %ProgramFiles%\ndnlmjc4m\n2qxotrhmdbl.exe
- %ProgramFiles%\ndnlmjc4m\service.dat
- %ProgramFiles%\ndnlmjc4m\ntvhmjhmm2.ico
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
Deletes the following files
- %TEMP%\nsj8a36.tmp\othgyzrvmap.dll
- %TEMP%\a906.tmp-shm
- %TEMP%\a904.tmp
- %TEMP%\a674.tmp
- %TEMP%\a674.tmp-shm
- %TEMP%\a662.tmp
- %WINDIR%\temp\wjm52e0.tmp
- %TEMP%\a906.tmp
- %WINDIR%\temp\nstb51f.tmp\system.dll
- %WINDIR%\temp\nstb51f.tmp\nsiscrypt.dll
- %WINDIR%\temp\nstb51f.tmp\md5dll.dll
- %WINDIR%\temp\nstb51f.tmp\ipconfig.dll
- %WINDIR%\temp\nsyafbf.tmp\qqkrqtulk
- %WINDIR%\temp\nsyafbf.tmp\othgyzrvmap.dll
- %TEMP%\nsj8a36.tmp\qqkrqtulk
- %WINDIR%\temp\nstb51f.tmp\simplesc.dll
- %TEMP%\nsjab67.tmp
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js
Network activity
Connects to
- 'te####logietazo.com':443
- 'te####logietazo.com':80
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://te####logietazo.com/addon/mapping?v=################################################################################################################################################
- http://ww##.###hnologietazo.com/addon/mapping?v=#################################################################################################################################################...
- http://ww##.###hnologietazo.com/installer/downloadsLog?un######################################################################################################
- http://ww##.###hnologietazo.com/installer/urlsLog?un##################################################################################################################
- http://x1.#.lencr.org/
HTTP POST requests
- http://te####logietazo.com/installer/downloadsLog?un##########################################################
Other
- 'te####logietazo.com':443
UDP
- DNS ASK te####logietazo.com
- DNS ASK ww##.###hnologietazo.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' --install_updater 0
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' --service
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe'
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' I4YjdmNTkw mE2ZjU3ZD MDUxY2I0O DY4NT jZjMyND zg1NjUwNjE Njk2MWI4 NTIyZmEzY2
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' --start_watcher_delay 30
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"
- '<SYSTEM32>\rundll32.exe' %WINDIR%\qdjopjioxyusqfbarfc.qdjo CsxTBUtnspzAYmQakbgq
- '%WINDIR%\syswow64\sc.exe' start ZTZjYzE0ZGFhMGJlNGM
- '%WINDIR%\syswow64\sc.exe' start OTU0ODhkYjgwND
- '%WINDIR%\syswow64\sc.exe' create OTU0ODhkYjgwND binpath= "<DRIVERS>\OTU0ODhkYjgwND" DisplayName= OTU0ODhkYjgwND type= kernel start= system group= PNP_TDI
- '%WINDIR%\syswow64\sc.exe' failure ZTZjYzE0ZGFhMGJlNGM reset= 30 actions= restart/5000
- '%WINDIR%\syswow64\sc.exe' create ZTZjYzE0ZGFhMGJlNGM binPath= "rundll32.exe %WINDIR%\qdjopjioxyusqfbarfc.qdjo CsxTBUtnspzAYmQakbgq" start= auto
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\sc.exe' failure NDNlMjc4M reset= 60 actions= restart/5000/restart/5000/restart/5000
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:64
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:32
- '%WINDIR%\syswow64\sc.exe' delete --
- '%WINDIR%\syswow64\net.exe' start --
- '%WINDIR%\syswow64\net1.exe' start --
- '%WINDIR%\syswow64\rundll32.exe' %WINDIR%\qdjopjioxyusqfbarfc.qdjo CsxTBUtnspzAYmQakbgq perform_update
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:32
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete --' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:32' (with hidden window)
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' --install_updater 0' (with hidden window)
- '%ProgramFiles%\ndnlmjc4m\nmfkzjk5ywv.exe' --service' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start --' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start OTU0ODhkYjgwND' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' failure NDNlMjc4M reset= 60 actions= restart/5000/restart/5000/restart/5000' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create OTU0ODhkYjgwND binpath= "<DRIVERS>\OTU0ODhkYjgwND" DisplayName= OTU0ODhkYjgwND type= kernel start= system group= PNP_TDI' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:64' (with hidden window)
