Trojan.Win32.Swrort.3_fbb85653d2 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1280
dlkvfitgsu.exe:560
dlkvfitgsu.exe:216
dlkvfitgsu.exe:348
zljp95kcl4rn60nx.exe:492
blpmlsyreut.exe:704
blpmlsyreut.exe:1524
zljp95kcl4rn61nx.exe:788
zljp95kcz9rasbnxzveuurs.exe:716
watnqba90szuo6q.exe:1604
zljp95kcl4rn5znx.exe:1980

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1280 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zljp95kcz9rasbnxzveuurs.exe (6329 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zljp95kcz9rasbnxzveuurs.exe (0 bytes)

The process dlkvfitgsu.exe:560 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\rng (44 bytes)
%System%\blpmlsyreut.exe (6841 bytes)
%System%\wnondlg\run (10 bytes)
%WinDir%\Temp\zljp95kcl4rn61nx.exe (26051 bytes)
%WinDir%\Temp\zljp95kcl4rn5znx.exe (35 bytes)
%System%\wnondlg\cfg (255 bytes)
%WinDir%\Temp\zljp95kcl4rn60nx.exe (6841 bytes)
%System%\wnondlg\tst (10 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\zljp95kcl4rn5znx.exe (0 bytes)

The process dlkvfitgsu.exe:216 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\rng (8 bytes)
%System%\blpmlsyreut.exe (7433 bytes)
%System%\wnondlg\run (10 bytes)
%System%\wnondlg\cfg (255 bytes)
%WinDir%\Temp\watnqba90szuo6q.exe (35 bytes)
%System%\wnondlg\tst (10 bytes)
%System%\wnondlg\cli (3 bytes)

The process dlkvfitgsu.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)

The process zljp95kcl4rn60nx.exe:492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)

The process blpmlsyreut.exe:704 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)

The process blpmlsyreut.exe:1524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)

The process zljp95kcl4rn61nx.exe:788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)
%System%\dlkvfitgsu.exe (7433 bytes)

The Trojan deletes the following file(s):

%System%\dlkvfitgsu.exe (0 bytes)

The process zljp95kcz9rasbnxzveuurs.exe:716 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wnondlg\tst (10 bytes)
%System%\dlkvfitgsu.exe (6841 bytes)

Registry activity

The process %original file name%.exe:1280 makes changes in the system registry.