Gen.Variant.Symmi.22722_4840427168 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

win32plot2.exe:1396
jrhwdmjgu925ubg.exe:1776
jrhwdmjgu925ubg.exe:3876
jrhwdmjgunjvubg.exe:2660
%original file name%.exe:1144
unzip.exe:3760
ckxjtyt.exe:1964
ckxjtyt.exe:2836
jrhwdmjgszdmubgkotiny.exe:2128
jrhwdmjgt1byubg.exe:2588
jrhwdmjgubkfubg.exe:3640
pogwoihcz.exe:3524
pogwoihcz.exe:2856

The Malware injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process jrhwdmjgunjvubg.exe:2660 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\bzntcdorshxs\tst (10 bytes)

The process %original file name%.exe:1144 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jrhwdmjgszdmubgkotiny.exe (3920 bytes)
%System%\bzntcdorshxs\tst (10 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jrhwdmjgszdmubgkotiny.exe (0 bytes)

The process unzip.exe:3760 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\binaries_burst4\win32\win32plot2.exe (673 bytes)
%System%\binaries_burst4\win64\win64burst2.exe (673 bytes)
%System%\binaries_burst4\win32\win32burst2.exe (673 bytes)
%System%\binaries_burst4\win64\win64plot2.exe (673 bytes)

The process ckxjtyt.exe:1964 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\bzntcdorshxs\tst (10 bytes)

The process ckxjtyt.exe:2836 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\binaries_burst4.zip (10700 bytes)
%System%\bzntcdorshxs\run (10 bytes)
%System%\bzntcdorshxs\rng (44 bytes)
%System%\unzip.exe (7100 bytes)
%System%\bzntcdorshxs\cfg (494 bytes)
%System%\pogwoihcz.exe (5873 bytes)
%WinDir%\Temp\jrhwdmjgu925ubg.exe (35 bytes)
%System%\bzntcdorshxs\tst (10 bytes)
%WinDir%\Temp\jrhwdmjgt1byubg.exe (35 bytes)
%WinDir%\Temp\jrhwdmjgubkfubg.exe (2820 bytes)
%WinDir%\Temp\jrhwdmjgunjvubg.exe (5873 bytes)

The Malware deletes the following file(s):

%WinDir%\Temp\jrhwdmjgt1byubg.exe (0 bytes)
%WinDir%\Temp\jrhwdmjgubkfubg.exe (0 bytes)
%WinDir%\Temp\jrhwdmjgu925ubg.exe (0 bytes)

The process jrhwdmjgszdmubgkotiny.exe:2128 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\bzntcdorshxs\etc (10 bytes)
%System%\ckxjtyt.exe (5873 bytes)
%System%\drivers\etc\hosts (22 bytes)
%System%\bzntcdorshxs\tst (10 bytes)

The Malware deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process pogwoihcz.exe:3524 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\bzntcdorshxs\tst (10 bytes)

The process pogwoihcz.exe:2856 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\bzntcdorshxs\tst (10 bytes)

Registry activity

The process win32plot2.exe:1396 makes changes in the system registry.