Trojan.DownLoader44.59890

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop winmgmt /y

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\windows\amifldrv64.sys
%WINDIR%\temp\fwtsqmfile01.sqm

Network activity

Connects to

'cd#.##scordapp.com':443
'microsoft.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'cd#.##scordapp.com':443

UDP

DNS ASK cd#.##scordapp.com
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%Satana-TRGT%RANDOM%AB' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%Satana-TRGT%RANDOM%RV' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%Satana-TRGT%RANDOM%SG' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SU auto' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%Satana-TRGT%RANDOM%SL' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%Satana-TRGT%RANDOM%FA' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%Satana-TRGT%RANDOM%FU' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%Satana-TRGT%RANDOM%DQ' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%Satana-TRGT%RANDOM%MST' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SM Satana-SPPOFR-%RANDOM%' (with hidden window)
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /CS Satana-%RANDOM%RATTEDU' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net stop winmgmt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /C net start winmgmt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc stop winmgmt' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc start winmgmt' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c cls
'<SYSTEM32>\cmd.exe' /c @echo off
'<SYSTEM32>\cmd.exe' /c wmic csproduct get uuid
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\cmd.exe' /c @echo BIOS
'<SYSTEM32>\cmd.exe' /c wmic bios get serialnumber
'<SYSTEM32>\wbem\wmic.exe' bios get serialnumber
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%Satana-TRGT%RANDOM%MST
'<SYSTEM32>\cmd.exe' /c @echo MOTHERBOARD
'<SYSTEM32>\wbem\wmic.exe' baseboard get serialnumber
'<SYSTEM32>\cmd.exe' /c @echo Chassis
'<SYSTEM32>\cmd.exe' /c wmic systemenclosure get serialnumber
'<SYSTEM32>\wbem\wmic.exe' systemenclosure get serialnumber
'<SYSTEM32>\cmd.exe' /c @echo CPU
'<SYSTEM32>\cmd.exe' /c wmic cpu get serialnumber
'<SYSTEM32>\sc.exe' start winmgmt
'<SYSTEM32>\cmd.exe' /c @echo SMBIOS
'<SYSTEM32>\cmd.exe' /C sc start winmgmt
'<SYSTEM32>\sc.exe' stop winmgmt
'<SYSTEM32>\cmd.exe' /C sc stop winmgmt
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%Satana-TRGT%RANDOM%RV
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%Satana-TRGT%RANDOM%SG
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SU auto
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%Satana-TRGT%RANDOM%SL
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%Satana-TRGT%RANDOM%FA
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%Satana-TRGT%RANDOM%FU
'<SYSTEM32>\wbem\wmic.exe' cpu get serialnumber
'<SYSTEM32>\cmd.exe' /c wmic baseboard get serialnumber
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%Satana-TRGT%RANDOM%DQ
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /CS Satana-%RANDOM%RATTEDU
'<SYSTEM32>\cmd.exe' /C net stop winmgmt /y
'<SYSTEM32>\net1.exe' stop winmgmt /y
'<SYSTEM32>\cmd.exe' /C net start winmgmt /y
'<SYSTEM32>\net.exe' start winmgmt /y
'<SYSTEM32>\net1.exe' start winmgmt /y
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%Satana-TRGT%RANDOM%AB
'<SYSTEM32>\cmd.exe' /C %ALLUSERSPROFILE%\Microsoft\Windows\AMIDEWINx64.exe /SM Satana-SPPOFR-%RANDOM%
'<SYSTEM32>\cmd.exe' /c @echo If your serials changed, now ur done!