Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MciGkrwk' = '<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\tqgnnosw.sys'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Creates and executes the following:
- '%TEMP%\ekdbmtyq.exe' admin
- '%TEMP%\ekdbmtyq.exe' elevate
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\ekdbmtyq.exe"" admin
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: tqgnnosw.sys
- NtCreateKey, handler: tqgnnosw.sys
Modifies file system:
Creates the following files:
- %TEMP%\tqgnnosw.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
- <LS_APPDATA>\eyqtaont\mcigkrwk.exe
- %TEMP%\ekdbmtyq.exe
- %ALLUSERSPROFILE%\Application Data\bjdwbfvf.log
- <LS_APPDATA>\niuydqre.log
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Deletes the following files:
- %TEMP%\tqgnnosw.sys
Network activity:
Connects to:
- 'su#####rwhjfxdqbt.com':443
- 'xp###lpguj.com':443
- 'sd####lyavjif.com':443
- 'bj###vngsn.com':443
- 'la###jvqc.com':443
- 'de#####paoywbeccng.com':443
- 'vo#####uxkkmhbmuac.com':443
- 'ma###rada.com':443
- '74.##5.232.51':80
- 'po####jnvfauh.com':443
- 'qu###xiga.com':443
- 'fo#####ykmdxodav.com':443
UDP:
- DNS ASK da###lbs.com
- DNS ASK ke####bypwgfqyg.com
- DNS ASK kx#####oqnlfwfvisbb.com
- DNS ASK bg#####pdfqnqppg.com
- DNS ASK mq####itbbak.com
- DNS ASK xl####tggmabhpp.com
- DNS ASK py####pajlxoeoc.com
- DNS ASK gc###bgura.com
- DNS ASK iw###pbwppg.com
- DNS ASK oo####wmyxunlr.com
- DNS ASK il#####vfabsxnodio.com
- DNS ASK xa####olgpym.com
- DNS ASK pq#####thkuhlyoycp.com
- DNS ASK ri###mncox.com
- DNS ASK vk####pjiqwejsv.com
- DNS ASK rb###ssmhcx.com
- DNS ASK go####gvolnkcpo.com
- DNS ASK kp###ugumx.com
- DNS ASK wv####xvdjag.com
- DNS ASK bg###vwufi.com
- DNS ASK ox###xtyyr.com
- DNS ASK rd###uyxkh.com
- DNS ASK ej###jdfvkh.com
- DNS ASK rd###vyaon.com
- DNS ASK ec###nbib.com
- DNS ASK rd####tsxxsvkj.com
- DNS ASK mr####oxjgrnqm.com
- DNS ASK kg####ycaynei.com
- DNS ASK dv###yqhomu.com
- DNS ASK ah####mbxjqjon.com
- DNS ASK dq####ddwvllihp.com
- DNS ASK kb###agf.com
- DNS ASK wg###cdb.com
- DNS ASK ip#####knysfvomq.com
- DNS ASK dp####aikowymh.com
- DNS ASK yc####htqeenpso.com
- DNS ASK ge###kyac.com
- DNS ASK bing.com
- DNS ASK oq####mhigjfw.com
- DNS ASK cy#####pqdllvrxqu.com
- DNS ASK br####kmgndn.com
- DNS ASK ii###gbo.com
- DNS ASK ov###fobf.com
- DNS ASK gx###jxn.com
- DNS ASK la###jvqc.com
- DNS ASK bj###vngsn.com
- DNS ASK vu####bqnuot.com
- DNS ASK lq#####thqejaosnm.com
- DNS ASK wv#####liuqbakkxry.com
- DNS ASK er###qeq.com
- DNS ASK oq####sfugms.com
- DNS ASK fo#####ykmdxodav.com
- DNS ASK qu###xiga.com
- DNS ASK vo#####uxkkmhbmuac.com
- DNS ASK google.com
- DNS ASK ma###rada.com
- DNS ASK su#####rwhjfxdqbt.com
- DNS ASK de#####paoywbeccng.com
- DNS ASK xp###lpguj.com
- DNS ASK po####jnvfauh.com
- DNS ASK sd####lyavjif.com
- DNS ASK iu####gmqgyf.com
- DNS ASK vd####rwmhpvtw.com
- DNS ASK of###xwx.com
- DNS ASK we####bsrjjf.com
- DNS ASK pe####kmewcix.com
- DNS ASK mr###wva.com
- DNS ASK ib#####odpyxmfhyk.com
- DNS ASK fy#####lnlaedmnew.com
- DNS ASK hx###cpwyxh.com
- DNS ASK si####sxureorb.com
- DNS ASK sv####vugdxo.com
- DNS ASK wf###jxywb.com
- DNS ASK fb####kvhcgp.com
- DNS ASK gm#####jcwvaidubfha.com
- DNS ASK qb#####jlbetfrjfh.com
- DNS ASK ot####ndkmwgak.com
- DNS ASK tu####asasucgkv.com
- DNS ASK yy####ghkfwqpyq.com
- DNS ASK aa####jyvxlosy.com
- DNS ASK fm####ycqcllrql.com
- DNS ASK aj###vwcsnp.com