Trojan.Agent.CCPK_267100efc1

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2124
cswfd.exe:2276

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2124 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\cswfd.exe (1020884 bytes)

The process cswfd.exe:2276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1683461 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)

The Trojan deletes the following file(s):

C:\Miray (0 bytes)
C:\Mirat (0 bytes)
C:\Miraw (0 bytes)
C:\Mirap (0 bytes)
C:\Miraq (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Mirao (0 bytes)
C:\Miraj (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirac (0 bytes)

Registry activity

The process cswfd.exe:2276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\cswfd.exe"

Dropped PE files

MD5	File path
5e51cc8d88ab15baaca1b2ae97ab155a	c:\$Recycle.Bin .exe
2ba1fe769cea91c06ebfd83479feb8de	c:\%original file name%.exe .exe
374c547521ab64c6be6e55927b67c467	c:\BOOTSECT.BAK .exe
9bcb2e13608320b1582fe755445f22eb	c:\Boot .exe
08819f98eb129783c1cdef63474da37f	c:\Documents and Settings .exe
e7472d8b297023d26bbfdcbc1a3aad8d	c:\Perl .exe
cd94b4938c05c5453d5833a1de1a4ac9	c:\Program Files .exe
65fbe680341fb695934cb840bdce808a	c:\ProgramData .exe
2549139ceeb2c40c2ea0aeb04527d833	c:\ProgramData\Saaaalamm\Mira.h
122ebbe2c922b6e84e4c5ce030dc21fd	c:\ProgramData\cswfd.exe
83459a1b057f40645ab760073f068478	c:\System Volume Information .exe
ff473abae6e6175ca390bfca4b4b8af2	c:\Users .exe
2549139ceeb2c40c2ea0aeb04527d833	c:\Users\All Users\Saaaalamm\Mira.h
122ebbe2c922b6e84e4c5ce030dc21fd	c:\Users\All Users\cswfd.exe
18f7fbf7b9ddf5074c2ec9de8f91e28a	c:\Windows .exe
b9b7804e5f52c13b01c4320f58ba0edb	c:\XELDZ .exe
e5993aa0d6a0eff39e09c60f04141b2e	c:\autoexec.bat .exe
37bfd8c150c24743977bccf8dd8c8e89	c:\bootmgr .exe
cd37af89f8dd9b85e014c8d26d882432	c:\config.sys .exe
b4119731666f24882130b94258c83f1e	c:\marker .exe
b6dde2e68508493a2810ae32c2c22517	c:\original .exe
2fc3d6256ecb83f248fc4250714d8352	c:\pagefile.sys .exe
fb564cd0869c50850196388ce663723c	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:2124
   cswfd.exe:2276

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
   C:\ProgramData\cswfd.exe (1020884 bytes)
   C:\original .exe (1963131 bytes)
   C:\config.sys .exe (1963131 bytes)
   C:\bootmgr .exe (1963131 bytes)
   C:\Boot .exe (1963131 bytes)
   C:\Windows .exe (1963131 bytes)
   C:\ProgramData .exe (1963131 bytes)
   C:\$Recycle.Bin .exe (1683461 bytes)
   C:\BOOTSECT.BAK .exe (1963131 bytes)
   %Documents and Settings% .exe (1963131 bytes)
   C:\totalcmd .exe (1963131 bytes)
   C:\%original file name%.exe .exe (1963131 bytes)
   C:\Users .exe (1963131 bytes)
   C:\XELDZ .exe (1963131 bytes)
   C:\autoexec.bat .exe (1963131 bytes)
   C:\System Volume Information .exe (1963131 bytes)
   C:\marker .exe (1963131 bytes)
   %Program Files% .exe (1963131 bytes)
   C:\pagefile.sys .exe (1963131 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\cswfd.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.21465	8b164ac8ef3742f37830dc1842275667
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	758300	750843	4.89809	9f8d4f9a76ec4e7943209aab08f425d3

Dropped from:

619942a9382be8fd40c7f0abb401ceb6

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2
848fdda6a6f3b6a7f7a429e1769afb72
be37e5eb01d9a8ec73e532e9b9a49214

Network Activity

URLs

URL	IP
time.windows.com	40.118.106.130
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

cswfd.exe_2276:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\cswfd.exe

C:\ProgramData\cswfd.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL