Trojan.DownLoader45.64046

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-m6f86.tmp\is-v4n6c.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-ig7rr.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-2g74d.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-odesg.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-g7mn6.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-1tb7t.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-bosjl.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-rfh7o.tmp
%ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-d2lad.tmp
%ProgramFiles(x86)%\recoverystandartpbd\update\is-ji2f1.tmp
%ProgramFiles(x86)%\recoverystandartpbd\update\is-0d7qa.tmp
%ProgramFiles(x86)%\recoverystandartpbd\update\is-qnsnu.tmp
C:\users\public\desktop\is-k8g6d.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-a6fhv.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-suas3.tmp
%ProgramFiles(x86)%\recoverystandartpbd\unins000.dat
%ProgramFiles(x86)%\recoverystandartpbd\is-u35iv.tmp
%ProgramFiles(x86)%\recoverystandartpbd\recoverystandartpbd.exe
%ProgramFiles(x86)%\recoverystandartpbd\is-95anf.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-fouu4.tmp
%TEMP%\is-u2fia.tmp\_isetup\_regdll.tmp
%TEMP%\is-u2fia.tmp\_isetup\_setup64.tmp
%TEMP%\is-u2fia.tmp\_isetup\_shfoldr.dll
%TEMP%\is-u2fia.tmp\_isetup\_isdecmp.dll
%TEMP%\is-u2fia.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\recoverystandartpbd\is-75q62.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-nmkqu.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-l5tul.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-ht6pg.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-no38v.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-hgb4j.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-coplv.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-rueh3.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-ufrds.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-adr81.tmp
%ProgramFiles(x86)%\recoverystandartpbd\is-6lgcq.tmp
%TEMP%\ska.cab

Moves the following files

from %ProgramFiles(x86)%\recoverystandartpbd\is-75q62.tmp to %ProgramFiles(x86)%\recoverystandartpbd\unins000.exe
from C:\users\public\desktop\is-k8g6d.tmp to C:\users\public\desktop\wiserecovery.url
from %ProgramFiles(x86)%\recoverystandartpbd\update\is-qnsnu.tmp to %ProgramFiles(x86)%\recoverystandartpbd\update\updatelang.ini
from %ProgramFiles(x86)%\recoverystandartpbd\update\is-0d7qa.tmp to %ProgramFiles(x86)%\recoverystandartpbd\update\update.urs
from %ProgramFiles(x86)%\recoverystandartpbd\update\is-ji2f1.tmp to %ProgramFiles(x86)%\recoverystandartpbd\update\update.exe
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-d2lad.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qtiff4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-rfh7o.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qtga4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-bosjl.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qsvg4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-1tb7t.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qmng4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-g7mn6.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qjpeg4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-odesg.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qico4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\is-2g74d.tmp to %ProgramFiles(x86)%\recoverystandartpbd\plugins\imageformats\qgif4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-ig7rr.tmp to %ProgramFiles(x86)%\recoverystandartpbd\wiserecovery.url
from %ProgramFiles(x86)%\recoverystandartpbd\is-u35iv.tmp to %ProgramFiles(x86)%\recoverystandartpbd\wiserecovery.intermediate.manifest
from %ProgramFiles(x86)%\recoverystandartpbd\is-95anf.tmp to %ProgramFiles(x86)%\recoverystandartpbd\wiserecovery.ini
from %ProgramFiles(x86)%\recoverystandartpbd\is-6lgcq.tmp to %ProgramFiles(x86)%\recoverystandartpbd\registerlib.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-fouu4.tmp to %ProgramFiles(x86)%\recoverystandartpbd\qtnetwork4.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-adr81.tmp to %ProgramFiles(x86)%\recoverystandartpbd\msvcr100.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-ufrds.tmp to %ProgramFiles(x86)%\recoverystandartpbd\msvcp100.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-rueh3.tmp to %ProgramFiles(x86)%\recoverystandartpbd\license.txt
from %ProgramFiles(x86)%\recoverystandartpbd\is-coplv.tmp to %ProgramFiles(x86)%\recoverystandartpbd\libsc.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-hgb4j.tmp to %ProgramFiles(x86)%\recoverystandartpbd\libntfs.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-no38v.tmp to %ProgramFiles(x86)%\recoverystandartpbd\language.ini
from %ProgramFiles(x86)%\recoverystandartpbd\is-ht6pg.tmp to %ProgramFiles(x86)%\recoverystandartpbd\disksetting.cfg
from %ProgramFiles(x86)%\recoverystandartpbd\is-l5tul.tmp to %ProgramFiles(x86)%\recoverystandartpbd\disklog.log
from %ProgramFiles(x86)%\recoverystandartpbd\is-nmkqu.tmp to %ProgramFiles(x86)%\recoverystandartpbd\bluesearecv.dll
from %ProgramFiles(x86)%\recoverystandartpbd\is-a6fhv.tmp to %ProgramFiles(x86)%\recoverystandartpbd\turbosearch.exe
from %ProgramFiles(x86)%\recoverystandartpbd\is-suas3.tmp to %ProgramFiles(x86)%\recoverystandartpbd\recoverystandartpbd.exe

Network activity

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############

UDP

DNS ASK pe###igold.xyz

Miscellaneous

Searches for the following windows

ClassName: 'RecoveryStandartWindowsClassRTF5' WindowName: ''

Creates and executes the following

'%TEMP%\is-m6f86.tmp\is-v4n6c.tmp' /SL4 $F023A "<Full path to file>" 7677420 52736
'%ProgramFiles(x86)%\recoverystandartpbd\recoverystandartpbd.exe'
'%ProgramFiles(x86)%\recoverystandartpbd\recoverystandartpbd.exe' 4624c86c2d55b115db8fcaf87ff360e3

Executes the following