Trojan.GenericKD.1878345_4462910d01 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3936
%original file name%.exe:3640
xqhsahxo.exe:4040
xqhsahxo.exe:3960

The Trojan injects its code into the following process(es):

mscorsvw.exe:424
svchost.exe:3228
svchost.exe:1640
svchost.exe:340
jqs.exe:480
services.exe:760
lsass.exe:772
svchost.exe:928
svchost.exe:1012
svchost.exe:1096
svchost.exe:1144
svchost.exe:1188
spoolsv.exe:1432
Explorer.EXE:1948
wmiprvse.exe:3704

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xqhsahxo.exe (601 bytes)

The process %original file name%.exe:3640 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\BE432C2EE45E016635C9B13C029DA7E7 (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB3.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB2.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\BE432C2EE45E016635C9B13C029DA7E7 (144 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\B1AA84065EC5876DF7F06B36A34A8167 (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB7.tmp (2784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB4.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\B1AA84065EC5876DF7F06B36A34A8167 (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB6.tmp (56 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (56 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TarB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB5.tmp (0 bytes)

The process xqhsahxo.exe:4040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fwoixcmg.exe (601 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\orpnsuoi.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\goxbiuiu\orpnsuoi.exe (601 bytes)

Registry activity

The process mscorsvw.exe:424 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process %original file name%.exe:3640 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C FE 8F AE BE E3 86 A0 37 F3 C5 94 43 FF C9 8D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 0B 6C D9 77"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"6252DC40F71143A22FDE9EF7348E064251B18118"

The process xqhsahxo.exe:4040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"UAC_bypassed" = "TRUE"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 21 61 68 32 27 DE 1B DC 32 56 6C 32 3B C6 F5"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\wuauserv]
"Start" = "4"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"OrpNsuoi" = "%Documents and Settings%\%current user%\Local Settings\Application Data\goxbiuiu\orpnsuoi.exe"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "4"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"

The process xqhsahxo.exe:3960 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 6C C6 6B C2 F4 AA D1 49 B4 3F 47 D8 4D B2 3D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in USER32.dll:

TranslateMessage

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSASendTo
WSARecvFrom
WSASend
recv
WSARecv
send
closesocket
recvfrom
sendto

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
ZwQueryDirectoryFile

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:3936
%original file name%.exe:3640
xqhsahxo.exe:4040
xqhsahxo.exe:3960
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\xqhsahxo.exe (601 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\BE432C2EE45E016635C9B13C029DA7E7 (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB3.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB2.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\BE432C2EE45E016635C9B13C029DA7E7 (144 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\B1AA84065EC5876DF7F06B36A34A8167 (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TarB7.tmp (2784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB4.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\B1AA84065EC5876DF7F06B36A34A8167 (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CabB6.tmp (56 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fwoixcmg.exe (601 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\orpnsuoi.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\goxbiuiu\orpnsuoi.exe (601 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"OrpNsuoi" = "%Documents and Settings%\%current user%\Local Settings\Application Data\goxbiuiu\orpnsuoi.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: GrsPQQmZO
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2014
Legal Trademarks:
Original Filename: GrsPQQmZO.exe
Internal Name: GrsPQQmZO.exe
File Version: 1.0.0.0
File Description: GrsPQQmZO
Comments:
Language: Chinese (Simplified, PRC)

Company Name: Product Name: GrsPQQmZOProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2014Legal Trademarks: Original Filename: GrsPQQmZO.exeInternal Name: GrsPQQmZO.exeFile Version: 1.0.0.0File Description: GrsPQQmZOComments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	104852	104960	4.55459	9deea8789630da7346ab93c3d0d5e5bf
.rsrc	114688	1344	1536	2.73426	71a7d6d117eae797c4f3410fea2902b3
.reloc	122880	12	512	0.070639	35196a87dab0cd68cc38a311da629c5a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a26.d.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a26.d.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a26.d.akamai.net/msdownload/update/v3/static/trustedr/en/6252DC40F71143A22FDE9EF7348E064251B18118.crt
hxxp://crl.certum.pl/ca.crl	213.222.201.150
hxxp://crl.certum.pl/l3.crl	213.222.201.150
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	184.84.243.34
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	184.84.243.34
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/6252DC40F71143A22FDE9EF7348E064251B18118.crt	184.84.243.34
hgyudheedieibxy.com	94.126.178.29
google.com	74.125.226.67
anrylixwcbnjopdd.com	86.124.164.25
itktxexjghvvxa.com	176.31.62.76
knpqxlxcwtlvgrdyhd.com	95.141.36.218
hufqifjq.com	166.78.62.91
nvlyffua.com	217.23.13.42

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ca.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.certum.pl

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Thu, 09 Oct 2014 23:35:42 GMT

Server: Apache

Last-Modified: Thu, 17 Apr 2014 10:39:06 GMT

ETag: "30016-187-a472e680"

Accept-Ranges: bytes

Content-Length: 391

Connection: close

Content-Type: application/x-pkcs7-crl

0...0m0...*.H........0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA..140417102343Z..150417102343Z0...*.H..............p.hT.%2..../.........D.px.J...V...%:r;..U...Q...n.;a..R...E....l...Fi...z!}........EyF7......#_.v......wS.....gla.....,..n...Q.?.kH.U]...].q..}j..........~.Jy...."S...A..`S...c9n[.f.y.,n..{/`@s...a.].V0.g.c..^..o.\[G.CQ#.....s...[........>..a....... u..]...

GET /l3.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.certum.pl

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Thu, 09 Oct 2014 23:35:43 GMT

Server: Apache

Last-Modified: Thu, 09 Oct 2014 18:02:01 GMT

ETag: "30013-904b-3aabd840"

Accept-Ranges: bytes

Content-Length: 36939

Connection: close

Content-Type: application/x-pkcs7-crl

0..G0../...0...*.H........0x1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1.0...U....Certum Level III CA..141009180019Z..141019180019Z0..\0I..U{....lT...R.!....140116192758Z0&0...U.......0...U......20140116000000Z0I..V&. ...e*.]...(...140613120149Z0&0...U.......0...U......20140612000000Z0I..U.....P)qf........140807122748Z0&0...U.......0...U......20140801000000Z0/..^eO...k!.....A.p..140411112557Z0.0...U.......0/..@.y....ffV.5G."...140425104817Z0.0...U.......0/..."w..C...y.Y......131211092248Z0.0...U.......0/...>.........k......131126092304Z0.0...U.......0...-.....v..D.&/`...140327121639Z0.0...U.......0I..d.........&l.P....140415132817Z0&0...U.......0...U......20140415000000Z0I....~......]Z`...P..140519080323Z0&0...U.......0...U......20140519000000Z0/..`....s.{H.........140425094549Z0.0...U.......0I..SO...Q.B..ol..Z...131209152607Z0&0...U.......0...U......20131209000000Z0/..b7.......0....,...140326104440Z0.0...U.......0/..s..7eN*..g...!....140409121302Z0.0...U.......0/..U. ...9...n...i`..140515103511Z0.0...U.......0/....v2...o...._..%..140515100727Z0.0...U.......0/..^..)\..C.w...$....140125082547Z0.0...U.......0/..v.@.....5.~..1L...140409114918Z0.0...U.......0/..M..}q..6:F..j.....140411120841Z0.0...U.......0/..n.T.}.Q......T.>..140327122320Z0.0...U.......0/..Y..^f...udY.S.....140409120821Z0.0...U.......0/..vB..c.....w....Y..140411120240Z0.0...U.......0I..%.......I..x.3....121128122453Z0&0...U.......0...U......20121128000000Z0/..c.,j....qZ&..6Y(..130529130426Z0.0..

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Fri, 12 Sep 2014 18:02:51 GMT

Accept-Ranges: bytes

ETag: "80179bc4b3cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Cache-Control: max-age=8720

Date: Thu, 09 Oct 2014 23:35:41 GMT

Connection: keep-alive

X-CCC: US

X-CID: 2

1401CFCEB3C4C42958....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Cache-Control: max-age=8808

Date: Thu, 09 Oct 2014 23:35:41 GMT

Connection: keep-alive

X-CCC: US

X-CID: 2

MSCF....`.......,...................I.................,E.Y .authroot.stl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.....................@.....L.........KNAy8/"...f.......k..Jm7j....R.5q....Rz..!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m..._.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|.@.M.._.....7._6...C.0...A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?...........WE.Or..O>..{.'W2.........3m.O.u..Z8....H4@.w}.o:?~....]<!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!.........`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=...f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..].|......3..y..-./....K..6{...s.<R`.}6....?.......-..@.g..S....

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/6252DC40F71143A22FDE9EF7348E064251B18118.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Fri, 12 Sep 2014 18:02:51 GMT

Accept-Ranges: bytes

ETag: "80179bc4b3cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 784

Date: Thu, 09 Oct 2014 23:35:42 GMT

Connection: keep-alive

X-CCC: US

X-CID: 2

0...0............ 0...*.H........0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA0...020611104639Z..270611104639Z0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA0.."0...*.H.............0.............O|.%..>O..o.js.[Q......\...u......#R...3..-..v. 9....K...x.sC{.a..X..lf~...^Uc.......0h..<..n..Z.N4.6....P.m.B......AK.jk...~b.g..&_.&..O..W(....E.n.%].n9.../.G.r...[..S?....V.n..f.&...S.....O).B.^... ..h.......Fc..."....FY~.5,...].H3.T...o........;.Y.......0.0...U.......0....0...*.H.......................D.l.9>..n..!w..w... A......c..7..v$...L.=.go-...e1p......`{mX..I.c2.k.:...;....Q....4.. ...`.'l2w...r....?..$B..W..&C.......T(>.?..M.j.:...;.#.c.?..'y.LQ....].;..s.....nd.ZV....Lt..q;..G.io...^...|R......Yg...p...i....@Hj.5.)f.!.,.`*..J@.k.$...,s..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_3228:

.text

`.data

.rsrc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

RPCRT4.dll

NETAPI32.dll

ole32.dll

ntdll.dll

RegCloseKey

RegOpenKeyExW

GetProcessHeap

NtOpenKey

svchost.pdb

\PIPE\

Software\Microsoft\Windows NT\CurrentVersion\Svchost

\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\

5.1.2600.5512 (xpsp.080413-2111)

svchost.exe

Windows

Operating System

5.1.2600.5512

svchost.exe_3228_rwx_002B0000_00001000:

|C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xqhsahxo.exe

svchost.exe_3228_rwx_15110000_00071000:

`.rsrc

.text

`.rdata

@.data

.reloc

Gh.logWj

h.logPj

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

PeekNamedPipe

SetNamedPipeHandleState

WaitNamedPipeA

kernel32.dll

ExitWindowsEx

user32.dll

RegCloseKey

RegDeleteKeyA

RegEnumKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

advapi32.dll

modules.dll

{X-X-X-X-XX}

ntdll.dll

shlwapi.dll

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

%CommonProgramFiles%

\/*.*

\\.\pipe\

VWRQRh.exe

h.exe

ws2_32.dll

RegCreateKeyExA

ShellExecuteA

gdi32.dll

ole32.dll

rmnsoft.dll

google.com:80

bing.com:80

yahoo.com:80

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defender

Software\Microsoft\Windows\CurrentVersion\Policies

Software\Microsoft\Windows\CurrentVersion\Policies\Associations

Software\Microsoft\Windows\CurrentVersion\policies\system

\ SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

"ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Microsoft\Windows\CurrentVersion\Run

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Disposition: form-data; name="%s"

--%s--

%s /%s HTTP/1.1

Host: %s

User-Agent: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

gdiplus.dll

GdiplusShutdown

\\.\631D2408D44C4f47AC647AB96987D4D5

\Google\Chrome\User Data\Default\Cookies

\Google\Chrome\User Data\Default\Extension Cookies

%APPDATA%\Apple Computer\Safari\Cookies\Cookies.plist

%APPDATA%\Mozilla\Firefox\

%WinDir%\Application Data\Mozilla\Firefox\

profiles.ini

Profile%d

\cookies.txt

\cookies.sqlite

%APPDATA%\Opera\

\profile\cookies4.dat

\cookies4.dat

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Opera.exe

FireFox Cookies\Profile %d\cookies.txt

FireFox Cookies\Profile %d\cookies.sqlite

Chrome\Cookies

Chrome\Extension Cookies

Opera\Profile %d\cookies4.dat

Safari\Cookies.plist

getexec

complete.dat

SRQVWh.exe

h.exeVj

tvh.exe

PSSSSSSh

More information: hXXp://VVV.ibsensoftware.com/

.TNIRPTN.

com.%s.sdb

%s\cmd.%s.bat

start "" "%s"

"%%windir%%\%s\ntprint.exe"

"%%windir%%\system32\sdbinst.exe" "%s"

"%%windir%%\system32\sdbinst.exe" /q /u "%s"

SOFTWARE\Microsoft\Windows NT\CurrentVersion\

UAC_bypassed

cmd.exe

%TEMP%\p.exe

" %TEMP%\p.exe

SOFTWARE\Microsoft\Updates\Windows XP\SP4

SOFTWARE\Microsoft\Updates\Windows XP\SP3

SOFTWARE\Microsoft\Updates\Windows XP\SP10

SOFTWARE\Microsoft\Updates\Windows XP\SP0

SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages

wmic.exe QFE where "HotFixID='KB2778930'" get HotFixID, Description

\cache.dat

CheckBypassed ok

di32.dll

loader.exe

_CheckBypassed@0

\/{X-X-X-X-XX}

|ZwDelayExecution

%ProgramFiles%\Internet Explorer\iexplore.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

http\shell\open\command

chrome.exe

opera.exe

/C ""%s"" %s

/C ""%s""

svchost.exe

user32.DLL

p.exe

Rapport

:Zone.Identifier

consent.exe

%Program Files%\Internet Explorer\iexplore.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xqhsahxo.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\p.exe

RegOpenKeyA

RegEnumKeyA

ShellExecuteExA

keybd_event

EnumWindows

.rdata

.rsrc

n.iws

t.TNIRP

>.%s.t

s\cmd

PF8-.XU

O3$dS7"%U9

KERNEL32.DLL

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

2.1.0.3

ntprint.exe

RedirectEXE

%temp%\..\..\LocalLow\cmd.%username%.bat

svchost.exe_3228_rwx_20010000_00001000:

.text

`.rdata

@.data

.reloc

svchost.exe_1640:

.text

`.data

.rsrc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

RPCRT4.dll

NETAPI32.dll

ole32.dll

ntdll.dll

RegCloseKey

RegOpenKeyExW

GetProcessHeap

NtOpenKey

svchost.pdb

\PIPE\

Software\Microsoft\Windows NT\CurrentVersion\Svchost

\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\

5.1.2600.5512 (xpsp.080413-2111)

svchost.exe

Windows

Operating System

5.1.2600.5512

svchost.exe_1640_rwx_000C0000_00001000:

|C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xqhsahxo.exe

svchost.exe_1640_rwx_15110000_00071000:

`.rsrc

.text

`.rdata

@.data

.reloc

Gh.logWj

h.logPj

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

PeekNamedPipe

SetNamedPipeHandleState

WaitNamedPipeA

kernel32.dll

ExitWindowsEx

user32.dll

RegCloseKey

RegDeleteKeyA

RegEnumKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

advapi32.dll

modules.dll

{X-X-X-X-XX}

ntdll.dll

shlwapi.dll

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

%CommonProgramFiles%

\/*.*

\\.\pipe\

VWRQRh.exe

h.exe

ws2_32.dll

RegCreateKeyExA

ShellExecuteA

gdi32.dll

ole32.dll

rmnsoft.dll

google.com:80

bing.com:80

yahoo.com:80

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defender

Software\Microsoft\Windows\CurrentVersion\Policies

Software\Microsoft\Windows\CurrentVersion\Policies\Associations

Software\Microsoft\Windows\CurrentVersion\policies\system

\ SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

"ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Microsoft\Windows\CurrentVersion\Run

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Disposition: form-data; name="%s"

--%s--

%s /%s HTTP/1.1

Host: %s

User-Agent: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

gdiplus.dll

GdiplusShutdown

\\.\631D2408D44C4f47AC647AB96987D4D5

\Google\Chrome\User Data\Default\Cookies

\Google\Chrome\User Data\Default\Extension Cookies

%APPDATA%\Apple Computer\Safari\Cookies\Cookies.plist

%APPDATA%\Mozilla\Firefox\

%WinDir%\Application Data\Mozilla\Firefox\

profiles.ini

Profile%d

\cookies.txt

\cookies.sqlite

%APPDATA%\Opera\

\profile\cookies4.dat

\cookies4.dat

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Opera.exe

FireFox Cookies\Profile %d\cookies.txt

FireFox Cookies\Profile %d\cookies.sqlite

Chrome\Cookies

Chrome\Extension Cookies

Opera\Profile %d\cookies4.dat

Safari\Cookies.plist

getexec

complete.dat

SRQVWh.exe

h.exeVj

tvh.exe

PSSSSSSh

More information: hXXp://VVV.ibsensoftware.com/

.TNIRPTN.

com.%s.sdb

%s\cmd.%s.bat

start "" "%s"

"%%windir%%\%s\ntprint.exe"

"%%windir%%\system32\sdbinst.exe" "%s"

"%%windir%%\system32\sdbinst.exe" /q /u "%s"

SOFTWARE\Microsoft\Windows NT\CurrentVersion\

UAC_bypassed

cmd.exe

%TEMP%\p.exe

" %TEMP%\p.exe

SOFTWARE\Microsoft\Updates\Windows XP\SP4

SOFTWARE\Microsoft\Updates\Windows XP\SP3

SOFTWARE\Microsoft\Updates\Windows XP\SP10

SOFTWARE\Microsoft\Updates\Windows XP\SP0

SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages

wmic.exe QFE where "HotFixID='KB2778930'" get HotFixID, Description

\cache.dat

CheckBypassed ok

di32.dll

loader.exe

_CheckBypassed@0

\/{X-X-X-X-XX}

|ZwDelayExecution

%ProgramFiles%\Internet Explorer\iexplore.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

http\shell\open\command

chrome.exe

opera.exe

/C ""%s"" %s

/C ""%s""

svchost.exe

user32.DLL

p.exe

Rapport

:Zone.Identifier

consent.exe

%Program Files%\Internet Explorer\iexplore.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xqhsahxo.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\p.exe

RegOpenKeyA

RegEnumKeyA

ShellExecuteExA

keybd_event

EnumWindows

.rdata

.rsrc

n.iws

t.TNIRP

>.%s.t

s\cmd

PF8-.XU

O3$dS7"%U9

KERNEL32.DLL

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

2.1.0.3

ntprint.exe

RedirectEXE

%temp%\..\..\LocalLow\cmd.%username%.bat

svchost.exe_1640_rwx_20010000_00001000:

.text

`.rdata

@.data

.reloc

svchost.exe_1640_rwx_20031000_000A0000:

i

.iniu>

.exeuZH

=.datuLh

Q=.bpsuLh

.xmluIh

t%SVP

.iniu

.prfu1

h.log

Q.Rjv

H.Qjv

#$%&'()* ,--

-4-4--567

s%j.Zf

j%Xf;

>%u[f

FtpControl

32bit FTP

LeapFtp

SoftFx FTP

ClassicFTP

WebSitePublisher

FtpExplorer

Core ftp

Coffee cup ftp

FFFtp

TurboFtp

SmartFtp

BulletproofFTP

FtpCommander

Cute FTP

WS FTP

Windows/Total commander

PTF://

Password

password

FtpIniName

\Ipswitch\WS_FTP Home\Sites

\Ipswitch\WS_FTP\Sites

\%.d.0

Quick.dat

port

sitemanager.xml

Port

Software\Microsoft\Windows\CurrentVersion\Uninstall

History.dat

Favorites.dat

\Frigate3\FtpSite.XML

\sites.xml

\FTPRush\RushSite.xml

SET PASS

NODE: TYPE = FTP

\BitKinex\bitkinex.ds

_Password

FtpUserName

FtpServer

FtpDirectory

FtpDescription

_FtpPassword

SELECT ServerName, Url, ServerUser, ServerPass, RemoteDir FROM "TServers"

SharedSettings.ccs

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

sites.dat

LeapFTP

HostPassword

\32BitFtp.ini

PassWord

%USERPROFILE%

Kernel32.dll

sql_trace

sqlite_version

sqlite_rename_trigger

sqlite_rename_table

RowKey

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL

f){-.gBsu1Z2^

3.3.14

Ad-d-d d:d:d

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps