Trojan.DownLoader30.32742

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '28e79d4a5a694d1c01ba953823d2048c' = '"%TEMP%\conhost.exe" ..'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '28e79d4a5a694d1c01ba953823d2048c' = '"%TEMP%\conhost.exe" ..'

Creates or modifies the following files

<SYSTEM32>\tasks\update\hwgugq
%APPDATA%\microsoft\windows\start menu\programs\startup\28e79d4a5a694d1c01ba953823d2048c.exe

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\conhost.exe" "conhost.exe" ENABLE

Injects code into

the following user processes:

conhost.exe

Modifies file system

Creates the following files

%TEMP%\conhost.exe
%TEMP%\attttt.xml
%TEMP%\core.exe
%TEMP%\axxxxx.xml
%TEMP%\asssss.xml
%TEMP%\afffff.xml
%TEMP%\ahhhhh.xml
%TEMP%\appppp.xml
%TEMP%\aggggg.xml
%TEMP%\a11111.xml
%TEMP%\ajjjjj.xml

Deletes the following files

%TEMP%\attttt.xml
%TEMP%\axxxxx.xml
%TEMP%\conhost.exe
%TEMP%\asssss.xml
%TEMP%\afffff.xml
%TEMP%\ahhhhh.xml
%TEMP%\appppp.xml
%TEMP%\aggggg.xml
%TEMP%\a11111.xml
%TEMP%\ajjjjj.xml

Substitutes the following files

%TEMP%\conhost.exe
%TEMP%\attttt.xml
%TEMP%\ahhhhh.xml

Network activity

Connects to

'es##.ddns.net':1001

UDP

DNS ASK es##.ddns.net

Miscellaneous

Creates and executes the following

'%TEMP%\core.exe' -woohoo 912 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 892 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 2404 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 1680 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 3016 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 2308 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 3020 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 2184 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 616 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 1768 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 2336 %TEMP%\conhost.exe
'%TEMP%\core.exe' -woohoo 2612 %TEMP%\conhost.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aXXXXX.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aGGGGG.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aJJJJJ.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a11111.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aPPPPP.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\alllll.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aHHHHH.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\afffff.xml"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\conhost.exe" "conhost.exe" ENABLE' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aSSSSS.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\attttt.xml"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\attttt.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aXXXXX.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aSSSSS.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\afffff.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aHHHHH.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aPPPPP.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aGGGGG.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\a11111.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\aJJJJJ.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\HwgugQ" /XML "%TEMP%\alllll.xml"