Trojan.Agent.CCPK_cda3e5a329

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

hjcslh.exe:1072
%original file name%.exe:3188

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process hjcslh.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1359037 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)

The Trojan deletes the following file(s):

C:\Mirax (0 bytes)
C:\Miray (0 bytes)
C:\Mirau (0 bytes)
C:\Mirap (0 bytes)
C:\Miraq (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Mirai (0 bytes)
C:\Miraj (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirac (0 bytes)

The process %original file name%.exe:3188 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\hjcslh.exe (1020884 bytes)

Registry activity

The process hjcslh.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\hjcslh.exe"

Dropped PE files

MD5	File path
24b03c83493ff41e3eccb6f8c911ab40	c:\$Recycle.Bin .exe
d94bcd630dc0a0384fa34cacb73d9406	c:\BOOTSECT.BAK .exe
ec2fc2a77473c0ba1d887d94cd1e3927	c:\Boot .exe
bca37dc8ef6313a475ae116310d8aa11	c:\Documents and Settings .exe
64032d6985b60cc607ffbca307f65b0f	c:\Perl .exe
1f4e9951f5fdb6d62d2a725e8757b17f	c:\Program Files .exe
b1c0f4ba3292ffddb3a8efc3dc4d5354	c:\ProgramData .exe
0097732504850319971faed87f071fd4	c:\ProgramData\Saaaalamm\Mira.h
7ae21c2f70e010b854f2b23834e1e0a9	c:\ProgramData\hjcslh.exe
3511b234078eca8d11619bef779f957c	c:\System Volume Information .exe
1fb2408a711d998952d384ec5265e556	c:\Users .exe
0097732504850319971faed87f071fd4	c:\Users\All Users\Saaaalamm\Mira.h
7ae21c2f70e010b854f2b23834e1e0a9	c:\Users\All Users\hjcslh.exe
9df0d53be67f5b52b709d03ec3964461	c:\Windows .exe
c27da2cb233d5f0a1691c94a812296c8	c:\XELDZ .exe
ca9ab24a3f8416d88fb8370767b397a3	c:\autoexec.bat .exe
c287df4bd52d2b421f7ab3441fa01992	c:\bootmgr .exe
3963e5d676fa7ad7b516aef12a5634cf	c:\%original file name%.exe .exe
f97c5c70e76cbab2a1e7e1bfbbfb8f02	c:\config.sys .exe
ecd443da8d127e2c145431d4b546887f	c:\marker .exe
b598e9e26590d62e873d407a17ee1e55	c:\original .exe
29ccd9f3202d2c6b64a5e5142fd6687b	c:\pagefile.sys .exe
960ac805486c9a6b8a96b8a5800eea5e	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   hjcslh.exe:1072
   %original file name%.exe:3188

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\original .exe (1963131 bytes)
   C:\config.sys .exe (1963131 bytes)
   C:\bootmgr .exe (1963131 bytes)
   C:\Boot .exe (1963131 bytes)
   C:\Windows .exe (1963131 bytes)
   C:\ProgramData .exe (1963131 bytes)
   C:\$Recycle.Bin .exe (1359037 bytes)
   C:\BOOTSECT.BAK .exe (1963131 bytes)
   %Documents and Settings% .exe (1963131 bytes)
   C:\%original file name%.exe .exe (1963131 bytes)
   C:\totalcmd .exe (1963131 bytes)
   C:\Users .exe (1963131 bytes)
   C:\XELDZ .exe (1963131 bytes)
   C:\autoexec.bat .exe (1963131 bytes)
   C:\System Volume Information .exe (1963131 bytes)
   C:\marker .exe (1963131 bytes)
   %Program Files% .exe (1963131 bytes)
   C:\pagefile.sys .exe (1963131 bytes)
   C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
   C:\ProgramData\hjcslh.exe (1020884 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\hjcslh.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.22546	1999eec8e9c4cd12139326da6738ca99
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	758300	750855	4.88501	bad77f2b42d447fef9fa72d37b18e50b

Dropped from:

8b8ee0689dcacb1ae10c77cd10a4feb5

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

hjcslh.exe_1072:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\hjcslh.exe

C:\ProgramData\hjcslh.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL