Trojan.Spambot.BXC_df214aca7b

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1832

The Trojan injects its code into the following process(es):

rundll32.exe:136

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1832 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\ymazj.dll (169 bytes)

The process rundll32.exe:136 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\drivers\etc\hosts (25 bytes)

Registry activity

The process rundll32.exe:136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE E3 A3 09 6D 09 3F 29 57 CF E5 F7 6D F9 E6 06"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"DCOM Server 54573" = "{2C1CD3D7-86AC-4068-93BC-A02304B54573}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B54573}\InProcServer32]
"(Default)" = "%System%\ymazj.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B54573}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B54573}" = "DCOM Server 54573"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"DCOM Server"

Dropped PE files

MD5	File path
43a9d3500ccc395e8c793362761238e8	c:\WINDOWS\system32\ymazj.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1698 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.trendmicro.com
127.0.0.1	rads.mcafee.com
127.0.0.1	customer.symantec.com
127.0.0.1	liveupdate.symantec.com
127.0.0.1	us.mcafee.com
127.0.0.1	updates.symantec.com
127.0.0.1	www.nai.com
127.0.0.1	secure.nai.com
127.0.0.1	dispatch.mcafee.com
127.0.0.1	download.mcafee.com
127.0.0.1	www.my-etrust.com
127.0.0.1	mast.mcafee.com
127.0.0.1	ca.com
127.0.0.1	www.ca.com
127.0.0.1	networkassociates.com
127.0.0.1	www.networkassociates.com
127.0.0.1	avp.com
127.0.0.1	www.kaspersky.com
127.0.0.1	www.avp.com
127.0.0.1	downloads4.kaspersky-labs.com
127.0.0.1	downloads3.kaspersky-labs.com
127.0.0.1	downloads2.kaspersky-labs.com
127.0.0.1	downloads1.kaspersky-labs.com
127.0.0.1	www.f-secure.com
127.0.0.1	viruslist.com
127.0.0.1	www.viruslist.com
127.0.0.1	liveupdate.symantecliveupdate.com
127.0.0.1	www.mcafee.com
127.0.0.1	sophos.com
127.0.0.1	www.sophos.com
127.0.0.1	securityresponse.symantec.com
127.0.0.1	www.symantec.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1832
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %System%\ymazj.dll (169 bytes)
   %System%\drivers\etc\hosts (25 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	24645	28672	4.28482	435fb9e9ae27d16446b07566140393e4
.rdata	32768	2586	4096	2.72913	602bd63ca0ee43c0f08f17d299e6ef7e
.data	36864	179800	176128	5.5037	190c1ef70ec959108b36bc2464233a48

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
196a61cc40e62af539c7d89f914fd2eb
3eca49a89595b1cc47e4390c5599d925
5ad4836d40fa5c253a3bf0a3b835417e
a1d90013dac242315ff39119e09962d4

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rundll32.exe_136:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

rundll32.exe_136_rwx_10001000_00D2B000:

.tTPV

.tTPV

^}•xy

^}•xy

FTPjK

FTPjK

FtPj;

FtPj;

F.PjRWj

F.PjRWj

u.WWj

u.WWj

u.VVj

u.VVj

portuguese-brazilian

portuguese-brazilian

user32.dll

user32.dll

zcÁ

zcÁ

- '%s'.

- '%s'.

GIF-LIB undefined error %d.

GIF-LIB undefined error %d.

GIF-LIB error: %s.

GIF-LIB error: %s.

%s: Null entry in quantized color map - that's weird.

%s: Null entry in quantized color map - that's weird.

GET /last2.php?id=%d HTTP/1.1

GET /last2.php?id=%d HTTP/1.1

Host: %s

Host: %s

EXCEPTION: addr=0xx, code=0xx; maindll base: 0xx, parent base: 0xx

EXCEPTION: addr=0xx, code=0xx; maindll base: 0xx, parent base: 0xx

ERROR: check_files failed (code %d)

ERROR: check_files failed (code %d)

ERROR: get_data_info failed (code %d)

ERROR: get_data_info failed (code %d)

ERROR: download_data failed (code %d)

ERROR: download_data failed (code %d)

NOTE: downloading %s

NOTE: downloading %s

hXXp://%s/%s

hXXp://%s/%s

NOTE: bases are ok (age: %d)

NOTE: bases are ok (age: %d)

maindll.dll

maindll.dll

riched20.dll

riched20.dll

65.111.175.129

65.111.175.129

72.232.217.98

72.232.217.98

72.232.217.130

72.232.217.130

66.7.199.96

66.7.199.96

%u.%u.%u.%u.IN-ADDR.ARPA

%u.%u.%u.%u.IN-ADDR.ARPA

PIPELINING

PIPELINING

EHLO %s

EHLO %s

HELO %s

HELO %s

RCPT TO:

RCPT TO:

MAIL FROM:

MAIL FROM:

aol.com

aol.com

verizon.net

verizon.net

ameritech.net

ameritech.net

cox.net

cox.net

rr.com

rr.com

adelphia.net

adelphia.net

comcast.net

comcast.net

optonline.net

optonline.net

=X

=X

[%d-%d]

[%d-%d]

NUMBER(%d-%d)

NUMBER(%d-%d)

STR_RNDLEN(%d-%d)

STR_RNDLEN(%d-%d)