Trojan.Siggen14.45970

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent dcf2f3c623f59e32

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe

Hooks functions

in browsers

iexplore.exe process, wininet.dll module
firefox.exe process, nss3.dll module

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\weeklysheet1215.doc
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

%APPDATA%\iwtcrbh
%TEMP%\tmp91da.tmp
%TEMP%\tmp91d9.tmp
%TEMP%\tmp91c8.tmp
%TEMP%\tmp91c7.tmp
%TEMP%\tmp91c6.tmp
%TEMP%\tmp91b5.tmp
%TEMP%\tmp91b4.tmp
%TEMP%\tmp91b3.tmp
%TEMP%\tmp9184.tmp
%TEMP%\tmp91db.tmp
%TEMP%\tmp9183.tmp
%TEMP%\tmp9171.tmp
%TEMP%\906a.tmp-shm
%TEMP%\906a.tmp
%TEMP%\tmp9076.tmp
%TEMP%\tmp9075.tmp
%TEMP%\tmp9074.tmp
%TEMP%\tmp9045.tmp
%TEMP%\903b.tmp
%TEMP%\903a.tmp
%TEMP%\tmp9172.tmp
%TEMP%\tmp9274.tmp
%TEMP%\tmp9991.tmp
%TEMP%\tmp924b.tmp
%TEMP%\tmp9970.tmp
%TEMP%\tmp996f.tmp
%TEMP%\tmp996e.tmp
%TEMP%\tmp996d.tmp
%TEMP%\tmp995d.tmp
%TEMP%\tmp995c.tmp
%TEMP%\tmp92d6.tmp
%TEMP%\tmp92c5.tmp
%TEMP%\tmp9295.tmp
%TEMP%\9029.tmp
%TEMP%\tmp9294.tmp
%TEMP%\tmp9273.tmp
%TEMP%\tmp9262.tmp
%TEMP%\tmp9261.tmp
%TEMP%\tmp9260.tmp
%TEMP%\tmp925f.tmp
%TEMP%\tmp925e.tmp
%TEMP%\tmp924e.tmp
%TEMP%\tmp924d.tmp
%TEMP%\tmp924c.tmp
%TEMP%\tmp91eb.tmp
%TEMP%\tmp923a.tmp
%TEMP%\9018.tmp
%TEMP%\7fec.tmp
%TEMP%\tmp7282.tmp
%TEMP%\tmp7281.tmp
%TEMP%\tmp7271.tmp
%TEMP%\6605.tmp
%TEMP%\65e5.tmp
%TEMP%\46e0.tmp
%TEMP%\46b0.tmp-shm
%TEMP%\46b0.tmp
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\tmp7293.tmp
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%TEMP%\2ea4.exe
%TEMP%\fbb1.exe
%TEMP%\db35.exe
%TEMP%\c074.exe
%TEMP%\a748.exe
%TEMP%\9905.exe
%TEMP%\8a35.exe
%APPDATA%\utwcwdt
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%TEMP%\tmp8b4a.tmp
%TEMP%\tmp9014.tmp
%TEMP%\801c.tmp
%TEMP%\tmp9013.tmp
%TEMP%\tmp9002.tmp
%TEMP%\8ff8.tmp
%TEMP%\8bb3.tmp
%TEMP%\tmp8bbd.tmp
%TEMP%\tmp8b6e.tmp
%TEMP%\tmp8b5e.tmp
%TEMP%\tmp8b5d.tmp
%TEMP%\tmp8b4c.tmp
%TEMP%\tmp9024.tmp
%TEMP%\tmp8b4b.tmp
%TEMP%\tmp8b49.tmp
%TEMP%\tmp8b29.tmp
%TEMP%\tmp8b28.tmp
%TEMP%\tmp8b27.tmp
%TEMP%\tmp8b26.tmp
%TEMP%\tmp84ce.tmp
%TEMP%\tmp848f.tmp
%TEMP%\8185.tmp
%TEMP%\8107.tmp
%TEMP%\tmp7294.tmp
%TEMP%\tmp99a1.tmp

Sets the 'hidden' attribute to the following files

%APPDATA%\iwtcrbh
%APPDATA%\utwcwdt

Deletes the following files

%TEMP%\46b0.tmp-shm
%TEMP%\tmp924b.tmp
%TEMP%\tmp91db.tmp
%TEMP%\tmp91eb.tmp
%TEMP%\tmp91d9.tmp
%TEMP%\tmp91da.tmp
%TEMP%\tmp91c7.tmp
%TEMP%\tmp91c8.tmp
%TEMP%\tmp924d.tmp
%TEMP%\tmp923a.tmp
%TEMP%\tmp91b3.tmp
%TEMP%\tmp91b4.tmp
%TEMP%\tmp9183.tmp
%TEMP%\tmp9184.tmp
%TEMP%\tmp9171.tmp
%TEMP%\tmp9172.tmp
%TEMP%\tmp9075.tmp
%TEMP%\tmp91b5.tmp
%TEMP%\tmp8b4a.tmp
%TEMP%\tmp924c.tmp
%TEMP%\tmp9970.tmp
%TEMP%\tmp996f.tmp
%TEMP%\tmp996e.tmp
%TEMP%\tmp996d.tmp
%TEMP%\tmp995d.tmp
%TEMP%\tmp995c.tmp
%TEMP%\tmp92c5.tmp
%TEMP%\tmp92d6.tmp
%TEMP%\tmp9294.tmp
%TEMP%\tmp9295.tmp
%TEMP%\tmp9273.tmp
%TEMP%\tmp9274.tmp
%TEMP%\tmp9261.tmp
%TEMP%\tmp9262.tmp
%TEMP%\tmp925f.tmp
%TEMP%\tmp9260.tmp
%TEMP%\tmp924e.tmp
%TEMP%\tmp9076.tmp
%TEMP%\tmp91c6.tmp
%TEMP%\906a.tmp
%TEMP%\906a.tmp-shm
%TEMP%\tmp9045.tmp
%TEMP%\tmp7294.tmp
%TEMP%\tmp8b27.tmp
%TEMP%\tmp848f.tmp
%TEMP%\tmp84ce.tmp
%TEMP%\8185.tmp
%TEMP%\8107.tmp
%TEMP%\801c.tmp
%TEMP%\7fec.tmp
%TEMP%\tmp7293.tmp
%TEMP%\tmp8b29.tmp
%TEMP%\tmp7282.tmp
%TEMP%\tmp7281.tmp
%TEMP%\tmp7271.tmp
%TEMP%\6605.tmp
%TEMP%\65e5.tmp
%TEMP%\46e0.tmp
%TEMP%\46b0.tmp
%TEMP%\tmp9991.tmp
%TEMP%\tmp925e.tmp
%TEMP%\tmp8b28.tmp
%TEMP%\tmp8b4c.tmp
%TEMP%\tmp8b26.tmp
%TEMP%\tmp9074.tmp
%TEMP%\903b.tmp
%TEMP%\903a.tmp
%TEMP%\9029.tmp
%TEMP%\9018.tmp
%TEMP%\tmp9014.tmp
%TEMP%\tmp9024.tmp
%TEMP%\tmp9002.tmp
%TEMP%\tmp9013.tmp
%TEMP%\8ff8.tmp
%TEMP%\8bb3.tmp
%TEMP%\tmp8b6e.tmp
%TEMP%\tmp8bbd.tmp
%TEMP%\tmp8b5d.tmp
%TEMP%\tmp8b5e.tmp
%TEMP%\tmp8b4b.tmp
%TEMP%\tmp8b49.tmp
%TEMP%\tmp99a1.tmp

Deletes itself.

Network activity

Connects to

're######istforjuly10.xyz':80
'18#.#34.247.50':80
'45.##.235.238':45555
'ap#.ip.sb':443
'microsoft.com':80

TCP

HTTP GET requests

http://re######istforjuly10.xyz/raccon.exe
http://re######istforjuly10.xyz/reestr.exe

HTTP POST requests

http://re######istforjuly10.xyz/
http://45.##.235.238:45555/ via 45.##.235.238
http://18#.#34.247.50/

Other

'te##te.in':443
'sh####25.tumblr.com':443
'ap#.ip.sb':443

UDP

DNS ASK re#####listforjuly1.xyz
DNS ASK re#####listforjuly2.xyz
DNS ASK re#####listforjuly3.xyz
DNS ASK re#####listforjuly4.xyz
DNS ASK re#####listforjuly5.xyz
DNS ASK re#####listforjuly6.xyz
DNS ASK re#####listforjuly7.xyz
DNS ASK re#####listforjuly8.xyz
DNS ASK re#####listforjuly9.xyz
DNS ASK re######istforjuly10.xyz
DNS ASK 99###########older1002-01432599908032135.site
DNS ASK te##te.in
DNS ASK sh####25.tumblr.com
DNS ASK ap#.ip.sb
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\8a35.exe'
'%TEMP%\9905.exe'
'%TEMP%\a748.exe'
'%TEMP%\c074.exe'
'%TEMP%\db35.exe'
'%APPDATA%\iwtcrbh'
'%TEMP%\fbb1.exe'
'%TEMP%\2ea4.exe'
'%APPDATA%\iwtcrbh' ' (with hidden window)

Executes the following

'<SYSTEM32>\taskeng.exe' {258CA386-70DF-4E1E-98AC-3584123C37D5} S-1-5-21-1960123792-2022915161-3775307078-1001:igvexjlm\user:Interactive:[1]
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'