Trojan.DownLoader46.49136

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\idlei
<SYSTEM32>\tasks\servicess
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\spoolsvs
<SYSTEM32>\tasks\spoolsv
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\taskhostt
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\taskhost

Modifies file system

Creates the following files

C:\users\default\idle.exe
C:\users\default\6ccacd8608530f
<Current directory>\services.exe
<Current directory>\c5b4cb5e9653cc
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\spoolsv.exe
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\f3b6ecef712a24
C:\users\default user\firefox.exe
C:\users\default user\0fc223bdacedc3
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\0fc223bdacedc3
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\886983d96e3d3e
C:\msocache\all users\taskhost.exe
C:\msocache\all users\b75386f1303e64
%ProgramFiles(x86)%\microsoft office\office14\1033\winlogon.exe
%ProgramFiles(x86)%\microsoft office\office14\1033\cc11b995f2a76d

Network activity

Connects to

'a0####21.xsph.ru':80

TCP

HTTP GET requests

http://a0####21.xsph.ru/L1nc0In.php?5A###########################################################################################################################################################...
http://a0####21.xsph.ru/L1nc0In.php?5v###########################################################################################################################################################...

UDP

DNS ASK a0####21.xsph.ru

Miscellaneous

Creates and executes the following

'<Current directory>\services.exe'
'<Current directory>\services.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Default User\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 13 /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 9 /tr "'<Current directory>\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\winlogon.exe'" /rl HIGHEST /f