Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MciGkrwk' = '<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\tqgnnosw.sys'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtCreateKey, handler: tqgnnosw.sys
- NtOpenKey, handler: tqgnnosw.sys
Modifies file system:
Creates the following files:
- %TEMP%\ekdbmtyq.exe
- %ALLUSERSPROFILE%\Application Data\bjdwbfvf.log
- <LS_APPDATA>\niuydqre.log
- <LS_APPDATA>\eyqtaont\mcigkrwk.exe
- %TEMP%\tqgnnosw.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Deletes the following files:
- %TEMP%\tqgnnosw.sys
Network activity:
Connects to:
- '74.##5.232.51':80
- 'sa###hunter.com':443
UDP:
- DNS ASK google.com
- DNS ASK xt###hurjk.com
- DNS ASK db#####ohbhckuegu.com
- DNS ASK yl#####vpllovqwm.com
- DNS ASK hv###ppig.com
- DNS ASK dp####ucfiec.com
- DNS ASK vm####qngjqi.com
- DNS ASK qg#####gnslvbywpv.com
- DNS ASK ed####xnoqvkg.com
- DNS ASK sb####mupbsjk.com
- DNS ASK mt#####pbnfklqel.com
- DNS ASK mn#####ljpiivcmwxw.com
- DNS ASK ws#####oyrcmyhymna.com
- DNS ASK ca####vrwptpnq.com
- DNS ASK dk####mlimcerh.com
- DNS ASK vx####mndbwdlh.com
- DNS ASK wo####pwmakrynt.com
- DNS ASK iu###bfjxvw.com
- DNS ASK jd####jihcuk.com
- DNS ASK fp####fisuekk.com
- DNS ASK yt###xta.com
- DNS ASK ti#####nmnptigje.com
- DNS ASK hq###tcv.com
- DNS ASK os###fdbvu.com
- DNS ASK nq####cbrpynvh.com
- DNS ASK kb#####ojfdoufjcjw.com
- DNS ASK wv#####iyjqivdtmfq.com
- DNS ASK io#####hsbqhqiwl.com
- DNS ASK ct#####hntqwltsg.com
- DNS ASK bing.com
- DNS ASK ue#####acktsvcunoh.com
- DNS ASK bh####otwosh.com
- DNS ASK xa###abf.com
- DNS ASK tn####qcplpmyr.com
- DNS ASK sa###hunter.com
- DNS ASK yf####qbsnghyln.com
- DNS ASK ty###wnkq.com
- DNS ASK ev###pofko.com
- DNS ASK hs###plirk.com
- DNS ASK kt####sckypuxwq.com
- DNS ASK ee###vadm.com
- DNS ASK sr####tydkmgvrp.com
- DNS ASK wa#####rfsvfomse.com
- DNS ASK av#####blpliagjma.com
- DNS ASK hv#####frskcivax.com
- DNS ASK bq###ulm.com
- DNS ASK pe###piltvr.com
- DNS ASK eu####mndmkklho.com
- DNS ASK fj###uwl.com
- DNS ASK rw###rwo.com
- DNS ASK eg#####krexhkxjuyu.com
- DNS ASK vy###vxgj.com
- DNS ASK uc###utcvsi.com
- DNS ASK jq####fwbicx.com
- DNS ASK ht#####rekiobxxyoy.com
- DNS ASK da###isp.com
- DNS ASK jb####niewkkdbv.com
- DNS ASK fw#####pivbagijwrd.com
- DNS ASK cl#####vfjagolwifam.com
- DNS ASK mj###ufp.com
- DNS ASK bq#####sanfwqlgkws.com
- DNS ASK ms####xrowicgf.com
- DNS ASK ch####kswlax.com
- DNS ASK or#####tqgppnmwyhkv.com
- DNS ASK pg###woure.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\ekdbmtyq.exe' elevate
- '%TEMP%\ekdbmtyq.exe' admin
Executes the following:
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\ekdbmtyq.exe"" admin