Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updater
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\UpdaterService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\UpdaterService] 'ImagePath' = '"%CommonProgramFiles(x86)%\Updater\updateservice.exe"'
Creates the following services
- 'UpdaterService' "%CommonProgramFiles(x86)%\Updater\updateservice.exe"
- 'UpdaterService' %CommonProgramFiles(x86)%\Updater\updateservice.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /T /im UPDateService.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /T /im schtasks.exe
- '<SYSTEM32>\taskkill.exe' /IM optimumdesk.exe /F
- '<SYSTEM32>\net.exe' stop odservice
- '<SYSTEM32>\taskkill.exe' /IM odservice.exe /F
- '<SYSTEM32>\taskkill.exe' /IM ODHook.exe /F
- '<SYSTEM32>\taskkill.exe' /IM ScreenConnect.ClientService.exe /F
- '<SYSTEM32>\taskkill.exe' /IM ScreenConnect.WindowsClient.exe /F
- '<SYSTEM32>\taskkill.exe' /IM SITSC.exe /F
- '<SYSTEM32>\taskkill.exe' /IM UpdaterMonitor.exe /F
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\schtasks.exe
Modifies file system
Creates the following files
- %TEMP%\is-t59pa.tmp\<File name>.tmp
- %CommonProgramFiles(x86)%\updater\interop.networklist.dll.temp
- %CommonProgramFiles(x86)%\updater\interop.wuapilib.dll.temp
- %CommonProgramFiles(x86)%\updater\keps.dll.temp
- %CommonProgramFiles(x86)%\updater\language0.lng.temp
- %CommonProgramFiles(x86)%\updater\language1.lng.temp
- %CommonProgramFiles(x86)%\updater\language2.lng.temp
- %CommonProgramFiles(x86)%\updater\log4net.dll.temp
- %CommonProgramFiles(x86)%\updater\metroset ui.dll.temp
- %CommonProgramFiles(x86)%\updater\newtonsoft.json.dll.temp
- %CommonProgramFiles(x86)%\updater\odhook.exe.temp
- %CommonProgramFiles(x86)%\updater\odrm.db.temp
- %CommonProgramFiles(x86)%\updater\odservice.exe.temp
- %CommonProgramFiles(x86)%\updater\odservice.exe.log4net.temp
- %CommonProgramFiles(x86)%\updater\openhardwaremonitorlib.dll.temp
- %CommonProgramFiles(x86)%\updater\optimumdesk.exe.temp
- %CommonProgramFiles(x86)%\updater\optimumdesk.exe.log4net.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.client.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.exe.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.exe.config.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.core.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windows.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windowsclient.exe.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windowsclient.exe.config.temp
- %CommonProgramFiles(x86)%\updater\sitsc.exe.temp
- %CommonProgramFiles(x86)%\updater\socketioclientdotnet.dll.temp
- %CommonProgramFiles(x86)%\updater\supersocket.clientengine.dll.temp
- %CommonProgramFiles(x86)%\updater\system.collections.immutable.dll.temp
- %CommonProgramFiles(x86)%\updater\toggleswitch.dll.temp
- %CommonProgramFiles(x86)%\updater\hook.dll.temp
- %CommonProgramFiles(x86)%\updater\updatermonitor.exe.temp
- %CommonProgramFiles(x86)%\updater\epagmanagerlib.dll.temp
- %CommonProgramFiles(x86)%\updater\dotras.dll.temp
- %TEMP%\is-vqeq3.tmp\_isetup\_regdll.tmp
- %TEMP%\is-vqeq3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-vqeq3.tmp\_isetup\_shfoldr.dll
- %CommonProgramFiles(x86)%\updater\is-a0gaj.tmp
- %CommonProgramFiles(x86)%\updater\odu.xml
- %CommonProgramFiles(x86)%\updater\installutil.installlog
- %CommonProgramFiles(x86)%\updater\updateservice.installlog
- %CommonProgramFiles(x86)%\updater\updateservice.installstate
- %CommonProgramFiles(x86)%\updater\clientid.db
- %CommonProgramFiles(x86)%\updater\serverid.db
- %CommonProgramFiles(x86)%\updater\serverkey.db
- %CommonProgramFiles(x86)%\updater\api_server.db
- %CommonProgramFiles(x86)%\updater\delivery_server.db
- %CommonProgramFiles(x86)%\updater\proactivitee_server.db
- %CommonProgramFiles(x86)%\updater\download_server.db
- %CommonProgramFiles(x86)%\updater\auth_server.db
- %CommonProgramFiles(x86)%\updater\screenconnect.db
- %CommonProgramFiles(x86)%\updater\scanserver.db
- %CommonProgramFiles(x86)%\updater\socket_server.db
- %CommonProgramFiles(x86)%\updater\assign_server.db
- %CommonProgramFiles(x86)%\updater\socket_server_port.db
- %CommonProgramFiles(x86)%\updater\cache.tmp
- %CommonProgramFiles(x86)%\updater\client.en-us.resources.temp
- %CommonProgramFiles(x86)%\updater\client.override.en-us.resources.temp
- %CommonProgramFiles(x86)%\updater\client.override.resources.temp
- %CommonProgramFiles(x86)%\updater\client.resources.temp
- %CommonProgramFiles(x86)%\updater\devcomponents.dotnetbar.charts.dll.temp
- %CommonProgramFiles(x86)%\updater\devcomponents.dotnetbar2.dll.temp
- %CommonProgramFiles(x86)%\updater\devcomponents.instrumentation.dll.temp
- %CommonProgramFiles(x86)%\updater\engineioclientdotnet.dll.temp
- %CommonProgramFiles(x86)%\updater\websocket4net.dll.temp
Deletes the following files
- %CommonProgramFiles(x86)%\updater\odu.xml
- %CommonProgramFiles(x86)%\updater\odrm.db.temp
- %CommonProgramFiles(x86)%\updater\odservice.exe.temp
- %CommonProgramFiles(x86)%\updater\odservice.exe.log4net.temp
- %CommonProgramFiles(x86)%\updater\openhardwaremonitorlib.dll.temp
- %CommonProgramFiles(x86)%\updater\optimumdesk.exe.temp
- %CommonProgramFiles(x86)%\updater\optimumdesk.exe.log4net.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.client.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.dll.temp
- %CommonProgramFiles(x86)%\updater\newtonsoft.json.dll.temp
- %CommonProgramFiles(x86)%\updater\odhook.exe.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.exe.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windows.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windowsclient.exe.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.windowsclient.exe.config.temp
- %CommonProgramFiles(x86)%\updater\sitsc.exe.temp
- %CommonProgramFiles(x86)%\updater\socketioclientdotnet.dll.temp
- %CommonProgramFiles(x86)%\updater\supersocket.clientengine.dll.temp
- %CommonProgramFiles(x86)%\updater\system.collections.immutable.dll.temp
- %CommonProgramFiles(x86)%\updater\toggleswitch.dll.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.clientservice.exe.config.temp
- %CommonProgramFiles(x86)%\updater\screenconnect.core.dll.temp
- %CommonProgramFiles(x86)%\updater\metroset ui.dll.temp
- %CommonProgramFiles(x86)%\updater\log4net.dll.temp
- %CommonProgramFiles(x86)%\updater\language2.lng.temp
- %TEMP%\is-vqeq3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-vqeq3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-t59pa.tmp\<File name>.tmp
- %CommonProgramFiles(x86)%\updater\cache.tmp
- %CommonProgramFiles(x86)%\updater\client.en-us.resources.temp
- %CommonProgramFiles(x86)%\updater\client.override.en-us.resources.temp
- %CommonProgramFiles(x86)%\updater\client.override.resources.temp
- %CommonProgramFiles(x86)%\updater\client.resources.temp
- %CommonProgramFiles(x86)%\updater\devcomponents.dotnetbar.charts.dll.temp
- %TEMP%\is-vqeq3.tmp\_isetup\_regdll.tmp
- %CommonProgramFiles(x86)%\updater\devcomponents.dotnetbar2.dll.temp
- %CommonProgramFiles(x86)%\updater\dotras.dll.temp
- %CommonProgramFiles(x86)%\updater\engineioclientdotnet.dll.temp
- %CommonProgramFiles(x86)%\updater\epagmanagerlib.dll.temp
- %CommonProgramFiles(x86)%\updater\hook.dll.temp
- %CommonProgramFiles(x86)%\updater\interop.networklist.dll.temp
- %CommonProgramFiles(x86)%\updater\interop.wuapilib.dll.temp
- %CommonProgramFiles(x86)%\updater\keps.dll.temp
- %CommonProgramFiles(x86)%\updater\language0.lng.temp
- %CommonProgramFiles(x86)%\updater\language1.lng.temp
- %CommonProgramFiles(x86)%\updater\devcomponents.instrumentation.dll.temp
- %CommonProgramFiles(x86)%\updater\updatermonitor.exe.temp
- %CommonProgramFiles(x86)%\updater\websocket4net.dll.temp
Moves the following files
- from %CommonProgramFiles(x86)%\updater\is-a0gaj.tmp to %CommonProgramFiles(x86)%\updater\updateservice.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
- DNS ASK up####.optimumdesk.com
- DNS ASK es######e.optimumdesk.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-t59pa.tmp\<File name>.tmp' /SL5="$B0206,82665,54784,<Full path to file>"
- '%TEMP%\is-vqeq3.tmp\_isetup\_setup64.tmp' 105 0x1E4
- '%CommonProgramFiles(x86)%\updater\updateservice.exe' +911
- '%CommonProgramFiles(x86)%\updater\updateservice.exe'
- '%WINDIR%\syswow64\schtasks.exe' /delete /TN Updater /F' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /im UPDateService.exe' (with hidden window)
- '%CommonProgramFiles(x86)%\updater\updateservice.exe' +911' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /TN Updater /XML "%CommonProgramFiles(x86)%\Updater\ODU.xml" /F' (with hidden window)
- '<SYSTEM32>\sc.exe' config UpdaterService type= own start= auto' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /change /enable /TN Updater' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config UpdaterService type= interact type= own start= auto' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /im schtasks.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /TN updater /TR "net start updateservice" /SC minute /MO 5 /RU SYSTEM' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start updaterservice' (with hidden window)
- '<SYSTEM32>\net.exe' start UpdaterService' (with hidden window)
- '<SYSTEM32>\sc.exe' config ODService type= own start= auto' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /delete /TN Updater /F
- '<SYSTEM32>\schtasks.exe' /create /TN Updater /XML "%CommonProgramFiles(x86)%\Updater\ODU.xml" /F
- '<SYSTEM32>\sc.exe' config UpdaterService type= own start= auto
- '<SYSTEM32>\schtasks.exe' /change /enable /TN Updater
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\net.exe' start UpdaterService
- '<SYSTEM32>\net1.exe' start UpdaterService
- '%WINDIR%\syswow64\sc.exe' config UpdaterService type= interact type= own start= auto
- '%WINDIR%\syswow64\schtasks.exe' /create /TN updater /TR "net start updateservice" /SC minute /MO 5 /RU SYSTEM
- '%WINDIR%\syswow64\net.exe' start updaterservice
- '%WINDIR%\syswow64\net1.exe' start updaterservice
- '<SYSTEM32>\schtasks.exe' /delete /TN ODA /F
- '<SYSTEM32>\schtasks.exe' /delete /TN ODS /F
- '<SYSTEM32>\net1.exe' stop odservice
- '<SYSTEM32>\sc.exe' config ODService type= own start= auto