Trojan.DownLoader33.35725

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\update\updates

Modifies file system

Creates the following files

%ProgramFiles(x86)%\updaters\updates.exe
%TEMP%\952583403.xml
%TEMP%\41799407.xml
%APPDATA%\imminent\logs\23-04-2020
%TEMP%\807807672.xml
%TEMP%\219161083.xml
%TEMP%\1650223421.xml
%TEMP%\238149263.xml
%TEMP%\1856483355.xml
%TEMP%\1753580770.xml
%TEMP%\34747250.xml
%TEMP%\739894189.xml

Deletes the following files

%TEMP%\952583403.xml
<SYSTEM32>\tasks\update\updates
%TEMP%\41799407.xml
%TEMP%\807807672.xml
%TEMP%\219161083.xml
%TEMP%\1650223421.xml
%TEMP%\238149263.xml
%TEMP%\1856483355.xml
%TEMP%\1753580770.xml
%TEMP%\34747250.xml
%TEMP%\739894189.xml

Network activity

Connects to

'bl#####a.duckdns.org':20007

UDP

DNS ASK bl#####a.duckdns.org

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\updaters\updates.exe'
'%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Update\Updates" /F' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\952583403.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\41799407.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\807807672.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\219161083.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1650223421.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\238149263.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1856483355.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1753580770.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\34747250.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\739894189.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\264683140.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1578661027.xml"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\794287459.xml"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Update\Updates" /F
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\952583403.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\41799407.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\807807672.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\219161083.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1650223421.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\238149263.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1856483355.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1753580770.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\34747250.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\739894189.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\264683140.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\1578661027.xml"
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\Updates" /XML "%TEMP%\794287459.xml"