Техническая информация
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\rundll32.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\~390346.tmp
- %TEMP%\bmc67e.tmp
Удаляет следующие файлы
- %TEMP%\~390346.tmp
Сетевая активность
TCP
Запросы HTTP GET
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_0_started_ext_ALRRR_N_OSBBB_64_OSNNN_Windows_7_Enterp...
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_22_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_23_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_24_process_dwm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_25_process_explorer.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_26_process_spoolsv.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_27_process_taskhost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_28_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_29_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_30_process_mdm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_31_process_WUDFHost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_32_process_iexplore.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_33_process_firefox.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_34_process_iexplore.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_35_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_36_process_OSPPSVC.EXE
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_37_process_audiodg.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_38_process_rundll32.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_21_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_39_process_adndfl.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_20_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_18_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_1_step_0
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_2_step_1
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_3_already_ok
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_4_mark_ok
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_5_process__System_Process_
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_4_watch2_start_657_585
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_6_process_System
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_8_process_smss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_9_process_csrss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_9_watch2_finish_575_595__1
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_10_process_wininit.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_12_process_csrss.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_13_process_winlogon.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_14_process_services.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_15_process_lsass.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_16_process_lsm.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_17_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_19_process_svchost.exe
- http://jp##.co.kr/report_N_0051_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_797078627477_75736572_BB7153C8_3724EB48_40_step_2
UDP
- DNS ASK jp##.co.kr
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\rundll32.exe' shell32.dll,Control_RunDLL
