Trojan.DownLoader46.25979

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7\49FA.exe" --AutoStart'

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent 1f24aa65a9795ced
<SYSTEM32>\tasks\time trigger task

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'RegmonClass', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%APPDATA%\thwubui
%APPDATA%\bwcerrg
%TEMP%\49fa.exe
%TEMP%\51b8.exe
%TEMP%\7aeb.exe
%TEMP%\kvsekvtmjkzriyh.data
%TEMP%\827b.dll
%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7\49fa.exe
%TEMP%\iwfmuerjwfewpav.data
%TEMP%\5244.tmp-shm
%TEMP%\6ac8.tmp-shm

Sets the 'hidden' attribute to the following files

%APPDATA%\thwubui
%APPDATA%\bwcerrg

Deletes the following files

%TEMP%\kvsekvtmjkzriyh.data
%TEMP%\iwfmuerjwfewpav.data
<SYSTEM32>\tasks\time trigger task
%TEMP%\5244.tmp-shm
%TEMP%\6ac8.tmp-shm

Deletes itself.

Network activity

Connects to

'su####lituyo.org':80
'sn####ukeutit.org':80
'li#####insteniki.org':80
'li####oumumy.org':80
'st#####luyastrelia.net':80
'ap#.2ip.ua':443
'pk#.goog':80
'79.##7.192.18':80
'ze##q.com':80
'co###umy.com':80

TCP

HTTP GET requests

http://pk#.goog/gsr1/gsr1.crt
http://79.##7.192.18/newmar.exe
http://co###umy.com/dl/build2.exe
http://ze##q.com/raud/get.php?pi#############################################
http://ze##q.com/files/1/build3.exe

HTTP POST requests

http://su####lituyo.org/
http://sn####ukeutit.org/
http://li#####insteniki.org/
http://li####oumumy.org/
http://st#####luyastrelia.net/

Other

'ap#.2ip.ua':443

UDP

DNS ASK on###ituyrs.org
DNS ASK su####lituyo.org
DNS ASK sn####ukeutit.org
DNS ASK li#####insteniki.org
DNS ASK li####oumumy.org
DNS ASK st#####luyastrelia.net
DNS ASK ap#.2ip.ua
DNS ASK pk#.goog
DNS ASK ze##q.com
DNS ASK co###umy.com

Miscellaneous

Searches for the following windows

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%TEMP%\49fa.exe'
'%TEMP%\51b8.exe'
'%TEMP%\7aeb.exe'
'%TEMP%\49fa.exe' --Admin IsNotAutoStart IsNotTask
'%APPDATA%\thwubui'
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\12E.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\831.bat" "' (with hidden window)
'%APPDATA%\uuwubui' ' (with hidden window)
'%APPDATA%\thwubui' ' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s %TEMP%\827B.dll
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\831.bat" "
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\12E.bat" "
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
'<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'%ProgramFiles%\Google\Chrome\updater.exe'"
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles%...
'<SYSTEM32>\taskeng.exe' {C2B21F1F-2A0E-469B-A6C8-0F1E93A395CD} S-1-5-21-3150914307-1777937420-491476919-1000:rphtqmpejiqh\user:Interactive:[1]
'<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\syswow64\net1.exe' helpmsg 20
'%WINDIR%\syswow64\net.exe' helpmsg 20
'%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
'<SYSTEM32>\sc.exe' stop dosvc
'%WINDIR%\syswow64\schtasks.exe' /Query