Trojan.DownLoader37.64468

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.5f1b5a2c-9ab1-4456-ad8d-a88cff4a7750
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\ecoo.edat
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\icarus-info.xml
%ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.36953f4e-2b76-4772-9670-726020339c78
%ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avast software\icarus\logs\report.log
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus_product.dll
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus_rvrt.exe
%ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cffffd03-703b-46db-9d47-29554410a830
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\dump_process.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\bug_report.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\product-def.xml
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\setupui.cont
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\product-info.xml
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\trid.edat
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus_ui.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\setupui.cont
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\94d58093-16f6-404d-8b80-2fc77223ecca
%ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\d71cd393-f1ac-4ebd-b010-1812c2da727f
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\product-info.xml
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\560d64d2-260d-499c-a527-c409a18b03d4
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\98727354-8827-4d8c-890c-3e4441799b35
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus_product.dll
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus_ui.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\product-def.xml
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\7e6ca623-3d91-4a4e-a333-ba91f27bd05c
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus_rvrt.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\037c4580-0ab6-4394-a958-21e86f1feb79
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\dump_process.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\05cc4e1e-f3e8-4de1-b96b-60c8003bce9c
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\bug_report.exe
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\fbf2aaed-d835-4ccd-8837-761956e9ab33
%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\f4c8bfa1-9eeb-46a6-a778-78710c993534
%ALLUSERSPROFILE%\avast software\icarus\logs\sui.log

Moves the following files

from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.5f1b5a2c-9ab1-4456-ad8d-a88cff4a7750 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.36953f4e-2b76-4772-9670-726020339c78 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cffffd03-703b-46db-9d47-29554410a830 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log

Network activity

Connects to

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\icarus-info.xml /install /sssid:2604
'%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus.exe' /sssid:2604 /er_master:master_ep_20267362-0e09-44c5-bc6e-c871f102cf1c /er_ui:ui_ep_eda920f2-6120-4a01-9e7c-923aa49d49f9 /er_slave:avast-tu_slave_ep_0cc9b68d-9af6-43a9-b9e8-2795d46bb431 /slave:a...
'%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus_ui.exe' /sssid:2604 /er_master:master_ep_20267362-0e09-44c5-bc6e-c871f102cf1c /er_ui:ui_ep_eda920f2-6120-4a01-9e7c-923aa49d49f9
'%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\avast-tu\icarus.exe' /sssid:2604 /er_master:master_ep_20267362-0e09-44c5-bc6e-c871f102cf1c /er_ui:ui_ep_eda920f2-6120-4a01-9e7c-923aa49d49f9 /er_slave:avast-tu_slave_ep_0cc9b68d-9af6-43a9-b9e8-2795d46bb431 /slave:a...' (with hidden window)
'%WINDIR%\temp\asw-9e42e0eb-82c9-4dc5-9e3d-9e66b5ab6413\common\icarus_ui.exe' /sssid:2604 /er_master:master_ep_20267362-0e09-44c5-bc6e-c871f102cf1c /er_ui:ui_ep_eda920f2-6120-4a01-9e7c-923aa49d49f9' (with hidden window)