Gen.Trojan.Heur.9y1vqu9UYmi_afb29b4fb8

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

afb29b4fb824f60:1072
yjngaj.exe:1420

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process afb29b4fb824f60:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (960207 bytes)
%Documents and Settings%\All Users\Application Data\yjngaj.exe (1018898 bytes)

The process yjngaj.exe:1420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\AUTOEXEC.BAT .exe (1963130 bytes)
C:\MSDOS.SYS .exe (1963130 bytes)
C:\IO.SYS .exe (1963130 bytes)
C:\boot.ini .exe (1963130 bytes)
%Documents and Settings% .exe (1963130 bytes)
C:\RECYCLER .exe (1963130 bytes)
C:\%original file name%.exe .exe (1963130 bytes)
C:\ntldr .exe (1963130 bytes)
C:\original .exe (1963130 bytes)
C:\totalcmd .exe (1963130 bytes)
C:\NTDETECT.COM .exe (1963130 bytes)
C:\System Volume Information .exe (1963130 bytes)
C:\CONFIG.SYS .exe (1963130 bytes)
C:\marker .exe (1963130 bytes)
%Program Files% .exe (1963130 bytes)
%WinDir% .exe (1963130 bytes)
C:\pagefile.sys .exe (1963130 bytes)

The Trojan deletes the following file(s):

C:\Mirat (0 bytes)
C:\Mirau (0 bytes)
C:\Mirav (0 bytes)
C:\Mirap (0 bytes)
C:\Miraq (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Mirai (0 bytes)
C:\Miraj (0 bytes)
C:\Mirak (0 bytes)
C:\Mirae (0 bytes)

Registry activity

The process afb29b4fb824f60:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 49 0F 57 BF EB 9B ED 13 E0 D4 0F B3 E6 67 CC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process yjngaj.exe:1420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\yjngaj.exe"

Dropped PE files

MD5	File path
9cc15baa91c3d4aba76c5ca171141b11	c:\AUTOEXEC.BAT .exe
479c0c58da3d145c14732d1119164400	c:\CONFIG.SYS .exe
dcb25a09a9b8036ec8f7833fc49ae7c0	c:\Documents and Settings .exe
2549139ceeb2c40c2ea0aeb04527d833	c:\Documents and Settings\All Users\Application Data\Saaaalamm\Mira.h
afec91f0f0de9c2000072e06abb90518	c:\Documents and Settings\All Users\Application Data\yjngaj.exe
21fde11c81fbec29f2469e02554ec122	c:\IO.SYS .exe
928ff12264637b39c446ec2c95a5fc71	c:\MSDOS.SYS .exe
f110b044caacb0456e8c028a95351dde	c:\NTDETECT.COM .exe
c9db2b6d48c36f067ebf472c99b6da9e	c:\Perl .exe
6d892a5b63c8045cc6138aa6945da6eb	c:\Program Files .exe
36a76967e2be5f614b2d4fd56a8749c5	c:\RECYCLER .exe
b8d4a009b5fd5d3212782bb28a92d213	c:\System Volume Information .exe
deb7470bbffb16cc96c9056b3ea1b6b9	c:\WINDOWS .exe
e9ca83e4c10097c2764ddcffc6a92692	c:\%original file name%.exe .exe
fd57f08f1208b29550e164bb91a8feff	c:\boot.ini .exe
bc5a81496c017493c706b981b3e2cc56	c:\marker .exe
9a7a37b2e51cf8aa849e90398a92291c	c:\ntldr .exe
b45ed80a7cf194acbbac3bc109ecba76	c:\original .exe
bb5f2ca9c40740a641dbbb04cd1a5a09	c:\pagefile.sys .exe
e86ceed9e41b1419bb6a6bbe64fcc9dd	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   afb29b4fb824f60:1072
   yjngaj.exe:1420

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (960207 bytes)
   %Documents and Settings%\All Users\Application Data\yjngaj.exe (1018898 bytes)
   C:\AUTOEXEC.BAT .exe (1963130 bytes)
   C:\MSDOS.SYS .exe (1963130 bytes)
   C:\IO.SYS .exe (1963130 bytes)
   C:\boot.ini .exe (1963130 bytes)
   %Documents and Settings% .exe (1963130 bytes)
   C:\RECYCLER .exe (1963130 bytes)
   C:\%original file name%.exe .exe (1963130 bytes)
   C:\ntldr .exe (1963130 bytes)
   C:\original .exe (1963130 bytes)
   C:\totalcmd .exe (1963130 bytes)
   C:\NTDETECT.COM .exe (1963130 bytes)
   C:\System Volume Information .exe (1963130 bytes)
   C:\CONFIG.SYS .exe (1963130 bytes)
   C:\marker .exe (1963130 bytes)
   %Program Files% .exe (1963130 bytes)
   %WinDir% .exe (1963130 bytes)
   C:\pagefile.sys .exe (1963130 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\yjngaj.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.21465	8b164ac8ef3742f37830dc1842275667
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	758300	750807	4.86882	660c296d0ac70433fe21933a4b730024

Dropped from:

3f618e70a4da49ea8ef5385dc45892a9

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

yjngaj.exe_1420:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

%Documents and Settings%\All Users\Application Data\yjngaj.exe

%Documents and Settings%\All Users\Application Data\yjngaj.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL