BackDoor.DarkCrystalNET.21

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\wmiprvsew
<SYSTEM32>\tasks\wmiprvse
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\systems
<SYSTEM32>\tasks\lsm
<SYSTEM32>\tasks\servicess
<SYSTEM32>\tasks\lsml
<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\csrss

Malicious functions

Searches for registry branches where third party applications store passwords

[HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]

Reads files which store third party applications passwords

%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\launcher.exe
<Current directory>\886983d96e3d3e
<Current directory>\csrss.exe
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\101b941d020240
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\lsm.exe
C:\kms\c5b4cb5e9653cc
C:\kms\services.exe
%ProgramFiles(x86)%\microsoft office\office14\1033\27d1bcfc3c54e0
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cookies.___
%ProgramFiles(x86)%\microsoft office\office14\1033\system.exe
C:\kms\wmiprvse.exe
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\cc11b995f2a76d
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\winlogon.exe
C:\hypercomponentwebsaves\ksbvo.vbe
C:\hypercomponentwebsaves\intohostcommon.exe
C:\hypercomponentwebsaves\9ah4jbjtgmldkuyu.bat
%TEMP%\dclauncher.exe
C:\kms\24dbde2999530e
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\formhistory.___

Deletes the following files

%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cookies.___
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\formhistory.___

Network activity

Connects to

'ip##o.is':80
'77.##.131.194':80

TCP

HTTP GET requests

http://ip##o.is/

UDP

DNS ASK ip##o.is
DNS ASK xf###sreborn.ru

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\launcher.exe'
'%TEMP%\dclauncher.exe'
'%WINDIR%\syswow64\wscript.exe' "C:\hyperComponentWebsaves\KsbVO.vbe"
'C:\hypercomponentwebsaves\intohostcommon.exe'
'C:\kms\services.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperComponentWebsaves\9Ah4JBJTGMLdkUyu.bat" "' (with hidden window)
'C:\kms\services.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperComponentWebsaves\9Ah4JBJTGMLdkUyu.bat" "
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'<Current directory>\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\lsm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\lsm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\lsm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\kms\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\kms\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\kms\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\kms\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\kms\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\kms\WmiPrvSE.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f