BackDoor.DarkCrystal.99

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\systems
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\system

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\firefox.exe
%TEMP%\84150e17-bfd2-45a0-b090-25dd4186b4a0.vbs
%TEMP%\fd67dddc-5bb8-44d2-80c8-7577c7ce27b1.vbs
%TEMP%\f50c22f3-a285-455c-889a-d96cf39b0e31.vbs
%TEMP%\1869c5a2-9c95-45f4-8254-734a6a13a4a0.vbs
%TEMP%\7a2d4448-0efa-4364-b989-66d488f4fc1f.vbs
%TEMP%\f146a865-cfe5-4753-be64-59e2e4703ab1.vbs
%TEMP%\c9f48d0d-58ca-4d6f-b2b3-f06047b9fecd.vbs
%TEMP%\742760bb-124b-4854-a907-8f0ca4a9c46b.vbs
%TEMP%\14fb1700-451e-48cc-bcae-4762d87e2b24.vbs
%TEMP%\288c47526dda2ee78bf4681bcfe2d26d35aea7b9.exe
%TEMP%\6cf1cf23-4988-42a0-9d5c-75fa3973fd4c.vbs
nul
%TEMP%\zrgfbmnbop.bat
%TEMP%\gkrahoj2bj
%ALLUSERSPROFILE%\start menu\27d1bcfc3c54e0
%ALLUSERSPROFILE%\start menu\system.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04e
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\0fc223bdacedc3
%TEMP%\7035e206-e3b4-4023-9bd3-6fae71250689.vbs
%TEMP%\1e888822-5285-4430-b6d1-2637a9d9bb61.vbs

Deletes the following files

%TEMP%\gkrahoj2bj
%TEMP%\6cf1cf23-4988-42a0-9d5c-75fa3973fd4c.vbs
%TEMP%\742760bb-124b-4854-a907-8f0ca4a9c46b.vbs
%TEMP%\f146a865-cfe5-4753-be64-59e2e4703ab1.vbs
%TEMP%\1869c5a2-9c95-45f4-8254-734a6a13a4a0.vbs
%TEMP%\fd67dddc-5bb8-44d2-80c8-7577c7ce27b1.vbs
%TEMP%\7035e206-e3b4-4023-9bd3-6fae71250689.vbs

Network activity

Connects to

'62.##9.23.26':80

TCP

HTTP GET requests

http://62.##9.23.26/pipepacketProcessorWordpress.php?Om##########################################################################################################################################...
http://62.##9.23.26/pipepacketProcessorWordpress.php?pb##########################################################################################################################################...
http://62.##9.23.26/pipepacketProcessorWordpress.php?YG##########################################################################################################################################...
http://62.##9.23.26/pipepacketProcessorWordpress.php?Ep##########################################################################################################################################...
http://62.##9.23.26/pipepacketProcessorWordpress.php?S7##########################################################################################################################################...

UDP

'localhost':123

Miscellaneous

Creates and executes the following

'C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\firefox.exe'
'<SYSTEM32>\wscript.exe' "%TEMP%\6cf1cf23-4988-42a0-9d5c-75fa3973fd4c.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\14fb1700-451e-48cc-bcae-4762d87e2b24.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\742760bb-124b-4854-a907-8f0ca4a9c46b.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\c9f48d0d-58ca-4d6f-b2b3-f06047b9fecd.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\f146a865-cfe5-4753-be64-59e2e4703ab1.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\7a2d4448-0efa-4364-b989-66d488f4fc1f.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\1869c5a2-9c95-45f4-8254-734a6a13a4a0.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\f50c22f3-a285-455c-889a-d96cf39b0e31.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\fd67dddc-5bb8-44d2-80c8-7577c7ce27b1.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\84150e17-bfd2-45a0-b090-25dd4186b4a0.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\7035e206-e3b4-4023-9bd3-6fae71250689.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\1e888822-5285-4430-b6d1-2637a9d9bb61.vbs"
'<SYSTEM32>\cmd.exe' /C "%TEMP%\zRgfBmnBop.bat"' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Start Menu\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Start Menu\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Start Menu\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\'
'<SYSTEM32>\cmd.exe' /C "%TEMP%\zRgfBmnBop.bat"
'<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
'<SYSTEM32>\wscript.exe' "%TEMP%\1f2a7ff9-a919-458e-a32d-735724ed4746.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\848bb857-c768-47fa-9a02-0a87f5968860.vbs"