Trojan.DownLoader45.45868

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-bc43s.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-2cmlb.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-6aknp.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-e7ae4.tmp
%ProgramFiles(x86)%\reg organizer\is-g4k51.tmp
%ProgramFiles(x86)%\reg organizer\is-0qdsl.tmp
%ProgramFiles(x86)%\reg organizer\is-10491.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-j50bp.tmp
%ProgramFiles(x86)%\reg organizer\is-iun5v.tmp
%ProgramFiles(x86)%\reg organizer\is-soblf.tmp
%ProgramFiles(x86)%\reg organizer\is-svik7.tmp
%ProgramFiles(x86)%\reg organizer\is-ljf50.tmp
%ProgramFiles(x86)%\reg organizer\is-rpbsd.tmp
%ProgramFiles(x86)%\reg organizer\is-vu58u.tmp
%ProgramFiles(x86)%\reg organizer\is-qgs1g.tmp
%ProgramFiles(x86)%\reg organizer\is-2d7l2.tmp
%ProgramFiles(x86)%\reg organizer\is-5r0qk.tmp
%ProgramFiles(x86)%\reg organizer\is-q5lkc.tmp
%ProgramFiles(x86)%\reg organizer\is-q1tt6.tmp
%ProgramFiles(x86)%\reg organizer\is-ka1b6.tmp
%ProgramFiles(x86)%\reg organizer\is-ulimr.tmp
%ProgramFiles(x86)%\reg organizer\is-nq791.tmp
%ProgramFiles(x86)%\reg organizer\is-09onh.tmp
%ProgramFiles(x86)%\reg organizer\is-fikal.tmp
%TEMP%\is-83ubb.tmp\_isetup\_iscrypt.dll
%TEMP%\is-83ubb.tmp\_isetup\_shfoldr.dll
%TEMP%\is-83ubb.tmp\_isetup\_setup64.tmp
%TEMP%\is-83ubb.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-fikal.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-e7ae4.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-g4k51.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-0qdsl.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-10491.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-j50bp.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-iun5v.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-soblf.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-svik7.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-ljf50.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-6aknp.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-rpbsd.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-qgs1g.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-2d7l2.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-5r0qk.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-q5lkc.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-q1tt6.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-ka1b6.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-ulimr.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-nq791.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-09onh.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-vu58u.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-2cmlb.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{f5ca82c8-66a3-35d4-9401-1d7a5baa3752}' WindowName: ''

Creates and executes the following

'%TEMP%\is-bc43s.tmp\<File name>.tmp' /SL5="$F0140,5460377,337408,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' 6db9bdcd5bbc218eef86167ae73dcf40

Executes the following