Trojan.Agent.CCPK_9f530e7fca

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1796
oorjd.exe:3428

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1796 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\oorjd.exe (1020884 bytes)

The process oorjd.exe:3428 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1963131 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)

The Trojan deletes the following file(s):

C:\Mirax (0 bytes)
C:\Miray (0 bytes)
C:\Mirat (0 bytes)
C:\Mirau (0 bytes)
C:\Miraq (0 bytes)
C:\Mirar (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Mirai (0 bytes)
C:\Mirak (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Mirab (0 bytes)

Registry activity

The process oorjd.exe:3428 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\oorjd.exe"

Dropped PE files

MD5	File path
f9fb503241379c7acd1c5f5ff62ac635	c:\$Recycle.Bin .exe
36798f40fd72bd10d08d64448d2bbe59	c:\%original file name%.exe .exe
49639b9420145aeda6fb39305c72607d	c:\BOOTSECT.BAK .exe
a5b7fa4e4de7a25de88a9bf389ddc94c	c:\Boot .exe
73c67e3f89da4ee8c7afa2a271f92ae6	c:\Documents and Settings .exe
38abd1aa442ee6fcc8d304e246162836	c:\Perl .exe
7878f98464326551e1250b0581b9d69c	c:\Program Files .exe
3b01682bc81bd04f1838f43a50d2bc96	c:\ProgramData .exe
0097732504850319971faed87f071fd4	c:\ProgramData\Saaaalamm\Mira.h
3fcd68c31e282f5b168e3d1ed10cf2ec	c:\ProgramData\oorjd.exe
2b2b078d69c27dfd07ee7505119164de	c:\System Volume Information .exe
c0e6088d8254d7920827e1109aa7fb99	c:\Users .exe
0097732504850319971faed87f071fd4	c:\Users\All Users\Saaaalamm\Mira.h
3fcd68c31e282f5b168e3d1ed10cf2ec	c:\Users\All Users\oorjd.exe
c5b0e99a28b41aeaa0454e54029ef5e4	c:\Windows .exe
e7ce0eec2f0425223b9f22af73a537f6	c:\XELDZ .exe
1a68b5ae6ed1fb05217c3450dbe1e62e	c:\autoexec.bat .exe
3394674161a31dc283074a21837a2959	c:\bootmgr .exe
443c5da365e623f21f8278f9ef2f1515	c:\config.sys .exe
1ee3538991d7256a79254c327c0b5353	c:\marker .exe
b8ca3b08ae06ac2a1c707e11afb0b37a	c:\original .exe
5e7c32324267befb4833ab29757101aa	c:\pagefile.sys .exe
6c28c32b7b6a98f4535d75c4fc57a7ba	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1796
   oorjd.exe:3428

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
   C:\ProgramData\oorjd.exe (1020884 bytes)
   C:\original .exe (1963131 bytes)
   C:\config.sys .exe (1963131 bytes)
   C:\bootmgr .exe (1963131 bytes)
   C:\Boot .exe (1963131 bytes)
   C:\Windows .exe (1963131 bytes)
   C:\ProgramData .exe (1963131 bytes)
   C:\$Recycle.Bin .exe (1963131 bytes)
   C:\BOOTSECT.BAK .exe (1963131 bytes)
   %Documents and Settings% .exe (1963131 bytes)
   C:\%original file name%.exe .exe (1963131 bytes)
   C:\totalcmd .exe (1963131 bytes)
   C:\Users .exe (1963131 bytes)
   C:\XELDZ .exe (1963131 bytes)
   C:\autoexec.bat .exe (1963131 bytes)
   C:\System Volume Information .exe (1963131 bytes)
   C:\marker .exe (1963131 bytes)
   %Program Files% .exe (1963131 bytes)
   C:\pagefile.sys .exe (1963131 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\oorjd.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.22546	1999eec8e9c4cd12139326da6738ca99
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	758300	750855	4.86448	a9bbca803a07f4fd45503241bf5c75c3

Dropped from:

930cb75554fc928cba0af75a1479e6e9

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
f8da9324483f9c24d8569ab1ccad5802
9d7a2154de72eee2c9963f9db6e6c755
76b6e0ae381195de6386fc2f9aab0876

Network Activity

URLs

URL	IP
dns.msftncsi.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

oorjd.exe_3428:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\oorjd.exe

C:\ProgramData\oorjd.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL