Trojan.DownLoader32.65531

Technical Information

Modifies file system

Creates the following files

<Current directory>\ncycmipca_std\tracecoleta.log
<Current directory>\microsoft.sqlserver.sqlenum.dll
<Current directory>\microsoft.sqlserver.sqlclrprovider.dll
<Current directory>\smokernel.dll
<Current directory>\activeds.dll
<Current directory>\regasm.exe
<Current directory>\coletasql.exe
<Current directory>\psrunner.exe
<Current directory>\psrunner_4.exe
%TEMP%\deletefilesstandalone.exe
<Current directory>\ncycmipca_std\ipconfig.txt
<Current directory>\ncycmipca_std\schedule.txt
%TEMP%\sce46975.tmp
<Current directory>\ncycmipca_std\saidainternet explorer.xml
<Current directory>\ncycmipca_std\statuscoletainternet explorer.txt
<Current directory>\ncycmipca_std\filelenghts.txt
<Current directory>\ncycmipca_std\saidainternet explorer.bzip
<Current directory>\ncycmipca_std\saida.xml
unc\10.0.26.17\pipe\srvsvc
<Current directory>\ncycmipca_std\statuscoleta.txt
<Current directory>\ncycmipca_std\jobs_taskscheduler.txt
<Current directory>\ncycmipca_std\systeminfo.txt
<Current directory>\ncycmipca_std\bcdedit.txt
<Current directory>\microsoft.sqlserver.management.sdk.sfc.dll
<Current directory>\ncycmipca_std\ips.txt
<Current directory>\microsoft.sqlserver.dmf.dll
<Current directory>\psapi.dll
<Current directory>\associationscriptfilename.txt
<Current directory>\scriptmicrosoft exchange server 2007.txt
<Current directory>\scriptmicrosoft exchange server 2010.txt
<Current directory>\scriptsql server 2000.txt
<Current directory>\scriptsql server 2005.txt
<Current directory>\scriptsql server 2008.txt
<Current directory>\scriptsql server 2012.txt
<Current directory>\scriptsql server 2014.txt
<Current directory>\scriptsql server 6.5.txt
<Current directory>\scriptsql server 7.0.txt
<Current directory>\zip32.dll
<Current directory>\microsoft.sqlserver.smo.dll
<Current directory>\zlib.dll
<Current directory>\zlibwapi.dll
<Current directory>\klog.dll
<Current directory>\coletaiis7.exe
<Current directory>\coletaiis7_4.exe
<Current directory>\microsoft.web.administration.dll
<Current directory>\sqldmo.dll
<Current directory>\sqldmo.rll
<Current directory>\msvcr71.dll
<Current directory>\microsoft.sqlserver.connectioninfo.dll
<Current directory>\microsoft.sqlserver.smoenum.dll
<Current directory>\ncycmipca_std\sp.ini

Deletes the following files

<Current directory>\ncycmipca_std\saidainternet explorer.xml
%TEMP%\sce46975.tmp
<Current directory>\ncycmipca_std\sp.ini
<Current directory>\ncycmipca_std\saida.xml
<Current directory>\ncycmipca_std\bcdedit.txt
<Current directory>\ncycmipca_std\filelenghts.txt
<Current directory>\ncycmipca_std\ipconfig.txt
<Current directory>\ncycmipca_std\ips.txt
<Current directory>\ncycmipca_std\jobs_taskscheduler.txt
<Current directory>\ncycmipca_std\saidainternet explorer.bzip
<Current directory>\ncycmipca_std\schedule.txt
<Current directory>\ncycmipca_std\statuscoleta.txt
<Current directory>\ncycmipca_std\statuscoletainternet explorer.txt
<Current directory>\ncycmipca_std\systeminfo.txt
<Current directory>\ncycmipca_std\tracecoleta.log
%TEMP%\deletefilesstandalone.exe

Network activity

TCP

'<LOCALNET>.26.17':445
'<LOCALNET>.26.17':49171

Miscellaneous

Creates and executes the following

'%TEMP%\deletefilesstandalone.exe' "<Current directory>\" NO
'%WINDIR%\syswow64\cmd.exe' /C ipconfig /all' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C schtasks /query /FO CSV /v' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C SystemInfo' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C bcdedit' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C secedit /export /quiet /cfg "<Current directory>\ncycmipca_std\SP.ini"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C ipconfig /all
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\cmd.exe' /C schtasks /query /FO CSV /v
'%WINDIR%\syswow64\schtasks.exe' /query /FO CSV /v
'%WINDIR%\syswow64\cmd.exe' /C SystemInfo
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\cmd.exe' /C bcdedit
'%WINDIR%\syswow64\cmd.exe' /C secedit /export /quiet /cfg "<Current directory>\ncycmipca_std\SP.ini"
'%WINDIR%\syswow64\secedit.exe' /export /quiet /cfg "<Current directory>\ncycmipca_std\SP.ini"