Trojan.DownLoader15.7835

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ChromeUpdate' = '%TEMP%\ChromeUpdate.exe'

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Registers BHO

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ded2e6b6-d56b-4ccb-89b1-cd99f8b4fc4d}]
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ded2e6b6-d56b-4ccb-89b1-cd99f8b4fc4d}\NoExplorer]
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ded2e6b6-d56b-4ccb-89b1-cd99f8b4fc4d}]
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ded2e6b6-d56b-4ccb-89b1-cd99f8b4fc4d}\NoExplorer]

Modifies file system

Creates the following files

%ProgramFiles(x86)%\i-beta\extensions\ie\adxregistrator.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\browser.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\firefox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\hideextensions.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\logo48.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\defaults\preferences\prefs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\locale\en-us\translations.dtd
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\skin\main.css
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxregistrator.exe
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxloader64.dll
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxloader.dll.manifest
%TEMP%\etilqs_c8vzwwlgo6bvhy0
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\ionic.zip.dll
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\microsoft.mshtml.dll
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\interop.shdocvw.dll
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxloader.dll
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\ibetaieext.dll
%HOMEPATH%\documents\add-in express\adxregistrator.log
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxloader.exe
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxloader64.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome\content\browser.js
%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\addinexpress.ie.dll
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\install.rdf
%ProgramFiles(x86)%\i-beta\extensions\ie\install.cmd
%ProgramFiles(x86)%\i-beta\extensions\ie\adxloader64.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\adxloader.dll.manifest
%ProgramFiles(x86)%\i-beta\extensions\ie\adxloader.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\addinexpress.ie.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\setup.exe
%ProgramFiles(x86)%\i-beta\extensions\ie\microsoft.mshtml.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\ionic.zip.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\interop.shdocvw.dll
%ProgramFiles(x86)%\i-beta\extensions\ie\ibetaieext.msi
%ProgramFiles(x86)%\i-beta\extensions\ie\ibetaieext.dll
%ProgramFiles(x86)%\i-beta\extensions\chrome\i-beta.crx
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\defaults\preferences\prefs.js
%TEMP%\chromeupdate.exe
%TEMP%\cfgd651.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\browser.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\browser.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\firefox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\icon64.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugin@i-beta.com\chrome\content\zepto.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\plugins@analytic-s.com\chrome.manifest
%TEMP%\etilqs_0bwlhb1sqjse9tr

Network activity

Connects to

'i-##ta.com':80
'localhost':49178
'localhost':49183

TCP

HTTP GET requests

http://www.i-##ta.com/status/?&c#####################################
http://www.i-##ta.com/status/?&c#########################################
http://www.i-##ta.com/status/?&c############################################
http://www.i-##ta.com/status/?&c####################################
http://www.i-##ta.com/status/?&c#################################
http://www.i-##ta.com/config/?&e###########################################################

UDP

DNS ASK i-##ta.com
DNS ASK go#####-analytics.com

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\i-beta.com\i-beta.com extension\adxregistrator.exe' /install="ibetaieext.dll" /privileges=admin
'%ProgramFiles(x86)%\mozilla firefox\firefox.exe' -silent' (with hidden window)

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /qnb /i "%ProgramFiles(x86)%\i-beta\Extensions\IE\\ibetaieext.msi" ALLUSERS=1
'%ProgramFiles(x86)%\mozilla firefox\firefox.exe' -silent
'%ProgramFiles(x86)%\mozilla firefox\firefox.exe'