Win32/Winnti

Installation

To install, this threat first creates a DLL file in the following folder:

• %ProgramFiles(x86)%\Common Files\Microsoft Shared\VC

It then runs the following command:

• rundll32.exe <dropped DLL>,Install

The command registers the DLL as a service, pointing to its export function ServiceDLL.

It also creates the following copy of the installer:

• %SystemRoot% \Help\dao18.cnt\

This threat might also create other files.

DLL components

• %TEMP% \tmpe.tmp 
• %TEMP% \tmpf.tmp

Driver components

• %SystemRoot% \drivers\acplec.sys
• %SystemRoot% \drivers\sp1itter.sys

It then adds the following registry entries to install the files:

• In subkey: HKLM\System\CurrentControlSet\Services\sp1itter
  Sets value: "Type"
  With data: "1"
• In subkey: HKLM\System\CurrentControlSet\Services\acplec
  Sets value: "Type"
  With data: "1"
• In subkey: HKLM\SYSTEM\CurrentControlSet\Services\SysmonLog
  Sets value: "ImagePath"
  With data: "%SystemRoot%\rundll32.exe %TEMP%\tmpf.tmp, check"
• In subkey: HKLM\SOFTWARE\Microsoft\HTMLHelp
  Sets value: "data" 
  With data: "tkfeu-kgsss-dzfnl-ijavu-kawii"

The installed driver component can hide the presence of the malware.

Payload

Gives a threat actor access to the device

This threat tries to connect to a remote attacker. It was observed to connect to the following addresses:

• ip.xx<removed>.co at TCP port 53
• kr.xx<removed>.co at TCP port 80
• www.<removed>trait.com at TCP port 53
• game.nex<removed>.net at TCP port 443
• aion.ree<removed>.net at TCP port 8080
• mail.7n<removed>.com at TCP port 25

With the connection, the threat actor can perform a host of actions, including:

• Delete files
• Download and run files, including other malware
• Launch remote commands
• Inject code into running processes
• Terminate processes

This threat can also inject malicious code to svchost.exe.