Gen.Variant.Razy.14896_6594951618 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mpugmzusx76tje5vm.exe:780
bnbhrwyv.exe:844
bnbhrwyv.exe:1232
%original file name%.exe:464
mpugmzusx76sje5vm.exe:544
qhowxotq.exe:956
qhowxotq.exe:1496
qhowxotq.exe:1996
pqyhflciqgytgwgv.exe:1324
mpugmzusx76uje5vm.exe:708
mpugmz81ytglje5vmixcpkhcv.exe:1076

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process mpugmzusx76tje5vm.exe:780 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\qhowxotq.exe (7433 bytes)
%System%\rsjvzfbgkltot\tst (10 bytes)

The Trojan deletes the following file(s):

%System%\qhowxotq.exe (0 bytes)

The process bnbhrwyv.exe:844 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\tst (10 bytes)

The process bnbhrwyv.exe:1232 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\tst (10 bytes)

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mpugmz81ytglje5vmixcpkhcv.exe (5442 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mpugmz81ytglje5vmixcpkhcv.exe (0 bytes)

The process qhowxotq.exe:956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\tst (10 bytes)

The process qhowxotq.exe:1496 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\rng (8 bytes)
%WinDir%\Temp\pqyhflciqgytgwgv.exe (35 bytes)
%System%\bnbhrwyv.exe (7433 bytes)
%System%\rsjvzfbgkltot\tst (10 bytes)
%System%\rsjvzfbgkltot\run (10 bytes)
%System%\rsjvzfbgkltot\cfg (163 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\pqyhflciqgytgwgv.exe (0 bytes)

The process qhowxotq.exe:1996 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\mpugmzusx76uje5vm.exe (7385 bytes)
%WinDir%\Temp\mpugmzusx76tje5vm.exe (26115 bytes)
%System%\rsjvzfbgkltot\rng (36 bytes)
%WinDir%\Temp\mpugmzusx76sje5vm.exe (35 bytes)
%System%\bnbhrwyv.exe (7385 bytes)
%System%\rsjvzfbgkltot\tst (10 bytes)
%System%\rsjvzfbgkltot\run (10 bytes)
%System%\rsjvzfbgkltot\cfg (163 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\mpugmzusx76sje5vm.exe (0 bytes)
%WinDir%\Temp\mpugmzusx76tje5vm.exe (0 bytes)

The process mpugmzusx76uje5vm.exe:708 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\rsjvzfbgkltot\tst (10 bytes)

The process mpugmz81ytglje5vmixcpkhcv.exe:1076 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\qhowxotq.exe (7385 bytes)
%System%\rsjvzfbgkltot\tst (10 bytes)

Registry activity

The process mpugmzusx76tje5vm.exe:780 makes changes in the system registry.