Trojan.DownLoader38.3464

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-l6jqu.tmp\<File name>.tmp
%ProgramFiles(x86)%\veniam\repellat\is-7pvik.tmp
%ProgramFiles(x86)%\veniam\repellat\is-c04bm.tmp
%ProgramFiles(x86)%\veniam\repellat\is-0b5oo.tmp
%ProgramFiles(x86)%\veniam\repellat\is-quik0.tmp
%ProgramFiles(x86)%\veniam\repellat\is-vrsga.tmp
%ProgramFiles(x86)%\veniam\libero\is-ee9rq.tmp
%ProgramFiles(x86)%\veniam\libero\is-kid6v.tmp
%ProgramFiles(x86)%\veniam\libero\is-ed8il.tmp
%ProgramFiles(x86)%\veniam\libero\is-vlbcl.tmp
%ProgramFiles(x86)%\veniam\hic\is-68dl9.tmp
%ProgramFiles(x86)%\veniam\hic\is-8dfdf.tmp
%ProgramFiles(x86)%\veniam\repellat\is-90qui.tmp
%ProgramFiles(x86)%\veniam\hic\is-pogvo.tmp
%ProgramFiles(x86)%\veniam\is-r7ifb.tmp
%ProgramFiles(x86)%\veniam\is-3jbaf.tmp
%ProgramFiles(x86)%\veniam\is-ab3ki.tmp
%ProgramFiles(x86)%\veniam\is-vjsm7.tmp
%ProgramFiles(x86)%\veniam\is-u4fl7.tmp
%ProgramFiles(x86)%\veniam\is-qq408.tmp
%ProgramFiles(x86)%\veniam\is-m55ua.tmp
%ProgramFiles(x86)%\veniam\is-q71nv.tmp
%TEMP%\is-0ab65.tmp\_isetup\_iscrypt.dll
%TEMP%\is-0ab65.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0ab65.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\veniam\is-s31rs.tmp
%ProgramFiles(x86)%\veniam\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\veniam\is-q71nv.tmp to %ProgramFiles(x86)%\veniam\unins000.exe
from %ProgramFiles(x86)%\veniam\repellat\is-c04bm.tmp to %ProgramFiles(x86)%\veniam\repellat\rerum.bat
from %ProgramFiles(x86)%\veniam\repellat\is-0b5oo.tmp to %ProgramFiles(x86)%\veniam\repellat\consequatur.rar
from %ProgramFiles(x86)%\veniam\repellat\is-quik0.tmp to %ProgramFiles(x86)%\veniam\repellat\aut.avi
from %ProgramFiles(x86)%\veniam\repellat\is-vrsga.tmp to %ProgramFiles(x86)%\veniam\repellat\alias.wav
from %ProgramFiles(x86)%\veniam\libero\is-ee9rq.tmp to %ProgramFiles(x86)%\veniam\libero\sqlite3.dll
from %ProgramFiles(x86)%\veniam\libero\is-kid6v.tmp to %ProgramFiles(x86)%\veniam\libero\ullam.ha
from %ProgramFiles(x86)%\veniam\libero\is-ed8il.tmp to %ProgramFiles(x86)%\veniam\libero\iusto.htm
from %ProgramFiles(x86)%\veniam\libero\is-vlbcl.tmp to %ProgramFiles(x86)%\veniam\libero\dolorum.exe
from %ProgramFiles(x86)%\veniam\hic\is-68dl9.tmp to %ProgramFiles(x86)%\veniam\hic\inventore.bat
from %ProgramFiles(x86)%\veniam\hic\is-8dfdf.tmp to %ProgramFiles(x86)%\veniam\hic\esse.avi
from %ProgramFiles(x86)%\veniam\hic\is-pogvo.tmp to %ProgramFiles(x86)%\veniam\hic\cum.html
from %ProgramFiles(x86)%\veniam\is-s31rs.tmp to %ProgramFiles(x86)%\veniam\voluptatem.wpd
from %ProgramFiles(x86)%\veniam\is-r7ifb.tmp to %ProgramFiles(x86)%\veniam\sit.wav
from %ProgramFiles(x86)%\veniam\is-3jbaf.tmp to %ProgramFiles(x86)%\veniam\quis.7z
from %ProgramFiles(x86)%\veniam\is-ab3ki.tmp to %ProgramFiles(x86)%\veniam\nemo.mp3
from %ProgramFiles(x86)%\veniam\is-vjsm7.tmp to %ProgramFiles(x86)%\veniam\necessitatibus.zip
from %ProgramFiles(x86)%\veniam\is-u4fl7.tmp to %ProgramFiles(x86)%\veniam\iste.log
from %ProgramFiles(x86)%\veniam\is-qq408.tmp to %ProgramFiles(x86)%\veniam\illum.pdf
from %ProgramFiles(x86)%\veniam\is-m55ua.tmp to %ProgramFiles(x86)%\veniam\facilis.rar
from %ProgramFiles(x86)%\veniam\repellat\is-7pvik.tmp to %ProgramFiles(x86)%\veniam\repellat\tempore.avi
from %ProgramFiles(x86)%\veniam\repellat\is-90qui.tmp to %ProgramFiles(x86)%\veniam\repellat\tenetur.wav

Network activity

TCP

HTTP POST requests

http://cl###etapi.com/v2/events

UDP

DNS ASK cl###etapi.com

Miscellaneous

Searches for the following windows

ClassName: '962F28A8-6AB7-401B-BF07-5A0013DD3E49' WindowName: ''

Creates and executes the following

'%TEMP%\is-l6jqu.tmp\<File name>.tmp' /SL5="$120226,3400275,114176,<Full path to file>"
'%ProgramFiles(x86)%\veniam\libero\dolorum.exe' f8d76440088541a44b6e0449834e16ca