Trojan.Siggen9.57672

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%TEMP%\dmfuttuvss.vbs
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%TEMP%\6d04.tmp
%TEMP%\xcaftftlbxua.exe
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\passwords_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\forms_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cc_list.txt
%LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cookies_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\moz_cookies.db-shm
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cookies\mozillafirefox_ctl4rbw.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\moz_forms.db
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cookies\mozillafirefox_vjzez8y.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\information.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\1723651.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\43561237n.txt
%PROGRAMDATA%\uukckkukyk\mtgvfazzvwtev.zip
%TEMP%\yllkowa.exe
%PROGRAMDATA%\uukckkukyk\files\_screen.jpg
%PROGRAMDATA%\uukckkukyk\files\_filepasswords.txt
%PROGRAMDATA%\uukckkukyk\172773668.txt
%TEMP%\nnyqiacxwau.exe
%LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
%PROGRAMDATA%\uukckkukyk\files\browsers\_filepasswords.txt
%APPDATA%\opera software\opera stable\logindatacopy
%LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
%PROGRAMDATA%\uukckkukyk\files\browsers\_fileforms.txt
%PROGRAMDATA%\uukckkukyk\files\browsers\_filecc.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\screensh0t.jpg
%PROGRAMDATA%\hmvkhiwaupddflwwq\moz_cookies.db
%APPDATA%\opera software\opera stable\webdatacopy
%APPDATA%\opera software\opera stable\cookiescopy
%PROGRAMDATA%\uukckkukyk\mocc.db
%PROGRAMDATA%\uukckkukyk\mocc.db-shm
%PROGRAMDATA%\uukckkukyk\files\browsers\cookies\mozilla_firefox_cookies_bsppdgt.txt
%PROGRAMDATA%\uukckkukyk\moff.db
%PROGRAMDATA%\uukckkukyk\files\browsers\cookies\mozilla_firefox_cookies_gofylut.txt
%PROGRAMDATA%\uukckkukyk\files\_info.txt
%TEMP%\rtwkanqxo.vbs
%PROGRAMDATA%\uukckkukyk\files\browsers\_filecookies.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\nl___2020_07_11___12_58___iqcwpc26j7.zip

Deletes the following files

%LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
%APPDATA%\opera software\opera stable\logindatacopy
%PROGRAMDATA%\uukckkukyk\files\browsers\_filecc.txt
%LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
%APPDATA%\opera software\opera stable\webdatacopy
%LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
%APPDATA%\opera software\opera stable\cookiescopy
%PROGRAMDATA%\uukckkukyk\mocc.db-shm
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\passwords_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\forms_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cc_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cookies_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\moz_cookies.db-shm

Substitutes the following files

%PROGRAMDATA%\uukckkukyk\files\browsers\_filecc.txt
%PROGRAMDATA%\uukckkukyk\mocc.db-shm
%LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\passwords_list.txt
%APPDATA%\opera software\opera stable\logindatacopy
%LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\forms_list.txt
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cc_list.txt
%APPDATA%\opera software\opera stable\webdatacopy
%LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
%PROGRAMDATA%\hmvkhiwaupddflwwq\files\cookies_list.txt
%APPDATA%\opera software\opera stable\cookiescopy
%PROGRAMDATA%\hmvkhiwaupddflwwq\moz_cookies.db-shm

Network activity

TCP

HTTP GET requests

http://ip##pi.com/line
http://ip##pi.com/json
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://eb#####adersoftware.com/download.php
http://eb#####adersoftware.com/ebook.exe

'ip###ger.org':443

UDP

DNS ASK ip###ger.org
DNS ASK ip##pi.com
DNS ASK fd##r05.top
DNS ASK 2n#.co
DNS ASK eb#####adersoftware.com
DNS ASK xe###s01.top

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\dmfuttuvss.vbs"
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\rtwkanqxo.vbs"
'%TEMP%\nnyqiacxwau.exe'
'%TEMP%\yllkowa.exe'
'%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\dmfuttuvss.vbs"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\rtwkanqxo.vbs"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\nnyqiacxwau.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\yllkowa.exe"' (with hidden window)

Executes the following