Gen.Variant.Kazy.288402_d9872a07f9 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2744
%original file name%.exe:2916
neaz.exe:2492
neaz.exe:2544

The Trojan injects its code into the following process(es):

Explorer.EXE:1948

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2916 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Ejizqy\neaz.exe (2452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IPM2A89.bat (173 bytes)

The process neaz.exe:2492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\ntuser.dat.LOG (5848 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6428 bytes)

Registry activity

The process %original file name%.exe:2744 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D DB 77 21 D4 C8 97 88 E2 B5 F7 63 D7 B3 82 E6"

The process %original file name%.exe:2916 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 82 83 DE 86 51 AA 0E BD B0 06 4C FA 8F 9F 13"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process neaz.exe:2492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 21 E3 F8 33 36 96 6D A9 8D B6 9D 58 C3 B9 A3"

[HKCU\Software\Microsoft\Obxidaule]
"23959ic7" = "umtV2w9fmYTKG2mFQ7s CA==#"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process neaz.exe:2544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 4E 83 60 92 F2 3C CE 88 67 03 7E D5 83 17 26"

Dropped PE files

MD5	File path
4aac371232ead0e1b127733a6865f363	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Ejizqy\neaz.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExW
HttpSendRequestExA
InternetWriteFile
InternetReadFileExA
InternetReadFileExW
HttpSendRequestA
HttpSendRequestW
InternetQueryDataAvailable
HttpQueryInfoW
InternetCloseHandle
HttpQueryInfoA
InternetReadFile

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan installs the following user-mode hooks in Secur32.dll:

UnsealMessage
SealMessage
DeleteSecurityContext

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2744
%original file name%.exe:2916
neaz.exe:2492
neaz.exe:2544
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Ejizqy\neaz.exe (2452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IPM2A89.bat (173 bytes)
%Documents and Settings%\%current user%\ntuser.dat.LOG (5848 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6428 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	25944	26112	4.07267	8426a1495a62c318d53ea1f0fbaa160a
.idata	32768	3532	3584	3.54497	c40fd005544f8011a9b339cbb7c52071
.CRT	36864	4	512	0.042395	9b48522a507c88a047d33270e55b537b
.rsrc	40960	14136	36864	4.84285	f866d6cd92f982bb522009d99a2fc76e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_1948_rwx_023F0000_00048000:

.text

`.data

.reloc

Invalid parameter passed to C runtime function.

)"4(7*

!*

0123456789

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

hXXp://VVV.google.com/

hXXp://VVV.bing.com/

REPORT

gdiplus.dll

GdiplusShutdown

RegDeleteKeyExW

HTTP/1.1

m9.td

t.Ht$HHt

ntdll.dll

KERNEL32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

GetKeyboardState

USER32.dll

CryptGetKeyParam

CryptImportKey

CryptDestroyKey

RegCreateKeyExW

RegCloseKey

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegFlushKey

RegEnumKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

ole32.dll

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

IPHLPAPI.DLL

VERSION.dll

msvcrt.dll

zcÃ

: :$:(:,:0:4:

7!7%7)7-7175797

4-5}5

:":(:3:9:

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s

"%s" %s

/c "%s"

kernel32.dll

urlmon.dll

launchpadshell.exe

dirclt32.exe

wtng.exe

prologue.exe

pcsws.exe

fdmaster.exe

shell32.dll

\StringFileInfo\xx\%s

cabinet.dll

Wadvapi32.dll

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Local Settings\Application Data

Global\{01E22063-0823-4088-6532-C4CE7D78E7DC}

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps