Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\ickkryus\qicwcyej.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'QicWcyej' = '%LOCALAPPDATA%\ickkryus\qicwcyej.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qicwcyej.exe
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\xtdefvwv.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\xtdefvwv.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\inarhbdpjveksclk.exe
- %ALLUSERSPROFILE%\fknmbpng.log
- %LOCALAPPDATA%\rjfodxjf.log
- %LOCALAPPDATA%\ickkryus\qicwcyej.exe
- %TEMP%\xtdefvwv.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qicwcyej.exe
Deletes the following files
- %TEMP%\xtdefvwv.sys
Network activity
UDP
- DNS ASK google.com
- DNS ASK nh####gxtgrnk.com
- DNS ASK mv#####wfkayjrqfni.com
- DNS ASK ex#####uxrdvhijan.com
- DNS ASK gy####siciis.com
- DNS ASK fx###tgx.com
- DNS ASK wa#####mnswdmbuhcn.com
- DNS ASK ga###slj.com
- DNS ASK rx###xbkc.com
- DNS ASK de###mdyvt.com
- DNS ASK hc###nlr.com
- DNS ASK sp####davslss.com
- DNS ASK sj###aml.com
- DNS ASK mf###hnjp.com
- DNS ASK jp####bipilmwsc.com
- DNS ASK hn#####vhxvuoeuap.com
- DNS ASK gv###sip.com
- DNS ASK kt###ueyc.com
- DNS ASK nk###xbt.com
- DNS ASK eo####abjwow.com
- DNS ASK qx####scxhradd.com
- DNS ASK ld###wwwgw.com
- DNS ASK kb###dsc.com
- DNS ASK jp#####akusewlaqfdt.com
- DNS ASK ap###ackpqd.com
- DNS ASK pv###jpvih.com
- DNS ASK nd#####nkplaavqsfa.com
- DNS ASK rb#####qgsmmnnvfv.com
- DNS ASK yb###abknhn.com
- DNS ASK tt####oohhkrhl.com
- DNS ASK da#####mpfufkvaa.com
- DNS ASK sh####mbrgcqoeh.com
- DNS ASK ft####jkomqdw.com
- DNS ASK an####ojndegpnm.com
- DNS ASK cp#####hyrueqcyxnvo.com
- DNS ASK bx###oxw.com
- DNS ASK pu#####fuxgquhguye.com
- DNS ASK qb###pyyooh.com
- DNS ASK ub####qslhqyy.com
- DNS ASK cx#####efolgkokdqy.com
- DNS ASK ti####axvmhsxtk.com
- DNS ASK ou###vkvn.com
- DNS ASK nv###npx.com
- DNS ASK sw###olov.com
- DNS ASK tf###oingy.com
- DNS ASK ji####yxjibyd.com
- DNS ASK kh#####kbwhfdiufhaj.com
- DNS ASK sn#####gcwgaafbtqkt.com
- DNS ASK ht#####rhtchwlhwklf.com
- DNS ASK ca###lnlrou.com
- DNS ASK uk####gdbdkd.com
- DNS ASK vw####yyutodtr.com
- DNS ASK vr####jxorlyen.com
- DNS ASK go#####vwvgqlretxd.com
- DNS ASK ye#####bbprvybwqn.com
- DNS ASK ku###xnntsk.com
- DNS ASK oc###ffwnj.com
- DNS ASK ya##o.com
- DNS ASK ya###fejdxs.com
- DNS ASK pg###yurf.com
- DNS ASK pp####dwufrb.com
- DNS ASK tf####kcgigiey.com
- DNS ASK ls#####qxvmogvxifm.com
- DNS ASK mu####pvxvrq.com
- DNS ASK ld####dyyxacm.com
- DNS ASK xw####iqjdsxk.com
- DNS ASK nc#####piawmchfylsy.com
- DNS ASK vo###yqdinl.com
- DNS ASK du#####abkuappgqxhp.com
- DNS ASK em#####wjuvvsvrwj.com
- DNS ASK rr###trt.com
- DNS ASK ks####hbmctx.com
Miscellaneous
Creates and executes the following
- '%TEMP%\inarhbdpjveksclk.exe' elevate
- '%TEMP%\inarhbdpjveksclk.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\inarhbdpjveksclk.exe"" admin
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\inarhbdpjveksclk.exe"" admin' (with hidden window)
