Trojan.Win32.Swrort_843c90b5bd

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:576
bmfit.exe:1372

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:576 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (537850 bytes)
%Documents and Settings%\All Users\Application Data\bmfit.exe (914498 bytes)

The process bmfit.exe:1372 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\AUTOEXEC.BAT .exe (1452114 bytes)
C:\MSDOS.SYS .exe (1452114 bytes)
C:\IO.SYS .exe (1452114 bytes)
C:\boot.ini .exe (1452114 bytes)
%Documents and Settings% .exe (1452114 bytes)
C:\RECYCLER .exe (1452114 bytes)
C:\ntldr .exe (1452114 bytes)
C:\original .exe (1452114 bytes)
C:\totalcmd .exe (1452114 bytes)
C:\NTDETECT.COM .exe (1452114 bytes)
C:\System Volume Information .exe (1452114 bytes)
C:\CONFIG.SYS .exe (1452114 bytes)
C:\marker .exe (1452114 bytes)
C:\%original file name%.exe .exe (1452114 bytes)
%Program Files% .exe (1452114 bytes)
%WinDir% .exe (1452114 bytes)
C:\pagefile.sys .exe (1452114 bytes)

The Trojan deletes the following file(s):

C:\Mirat (0 bytes)
C:\Mirau (0 bytes)
C:\Mirav (0 bytes)
C:\Miraw (0 bytes)
C:\Mirap (0 bytes)
C:\Miraq (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Mirah (0 bytes)
C:\Mirai (0 bytes)
C:\Miraj (0 bytes)
C:\Mirak (0 bytes)
C:\Mirad (0 bytes)
C:\Miraa (0 bytes)
C:\Mirab (0 bytes)

Registry activity

The process %original file name%.exe:576 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 3B F9 C7 78 9C 4B 4B 43 CB EE A6 3D 6D 29 17"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process bmfit.exe:1372 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\bmfit.exe"

Dropped PE files

MD5	File path
84a83e742d54f933109e1356d90c5c06	c:\%original file name%.exe .exe
1afd396c9d4b1b92ed474eecf000d488	c:\AUTOEXEC.BAT .exe
4077a8345cd003bf5f6d5243f9acf6b2	c:\CONFIG.SYS .exe
691f420eae668e6123e033003b9fe39f	c:\Documents and Settings .exe
15cccb964efeeb58f9cd8ebf5757b3a1	c:\Documents and Settings\All Users\Application Data\Saaaalamm\Mira.h
050adce300f59b3f31656f9614608e03	c:\Documents and Settings\All Users\Application Data\bmfit.exe
0b18bbdaa8b7dbca8148b6be38316a8b	c:\IO.SYS .exe
4ae1eab4906aad3ad9585628275ac6c4	c:\MSDOS.SYS .exe
5912823c260b112deb691bcfa8832d15	c:\NTDETECT.COM .exe
f2a31a936ee581023438f6344e09f0c6	c:\Perl .exe
7790d791d7195a237dcea879242f7306	c:\Program Files .exe
483a52b8163f28459df9b4370506e511	c:\RECYCLER .exe
831a92046aca4bdc8d613ebd3b62b174	c:\System Volume Information .exe
ab915d366a4f40ce5232fc76d99117e4	c:\WINDOWS .exe
809bc07dc46172ac596d3ad4000ec559	c:\boot.ini .exe
a062029266531c9b086d3d999ce66e4a	c:\marker .exe
a3b3de0c6489cecea5b309b7d9b366b3	c:\ntldr .exe
c8323a438a1483d8d911afe1212ab573	c:\original .exe
9cc55c9c2d857fb131e6d214ed554702	c:\pagefile.sys .exe
983cc485175d8b21826d2ab479ab584c	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:576
   bmfit.exe:1372

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (537850 bytes)
   %Documents and Settings%\All Users\Application Data\bmfit.exe (914498 bytes)
   C:\AUTOEXEC.BAT .exe (1452114 bytes)
   C:\MSDOS.SYS .exe (1452114 bytes)
   C:\IO.SYS .exe (1452114 bytes)
   C:\boot.ini .exe (1452114 bytes)
   %Documents and Settings% .exe (1452114 bytes)
   C:\RECYCLER .exe (1452114 bytes)
   C:\ntldr .exe (1452114 bytes)
   C:\original .exe (1452114 bytes)
   C:\totalcmd .exe (1452114 bytes)
   C:\NTDETECT.COM .exe (1452114 bytes)
   C:\System Volume Information .exe (1452114 bytes)
   C:\CONFIG.SYS .exe (1452114 bytes)
   C:\marker .exe (1452114 bytes)
   C:\%original file name%.exe .exe (1452114 bytes)
   %Program Files% .exe (1452114 bytes)
   %WinDir% .exe (1452114 bytes)
   C:\pagefile.sys .exe (1452114 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\bmfit.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.21465	8b164ac8ef3742f37830dc1842275667
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	26552	26624	4.28628	9ad058408721cc9b90b9060077a1c139

Dropped from:

ef79edb6c3a591728202e26b0e5fde84

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 6
b8fded3e584cf2df9e993c0d5aa2a230
b4e515b7eaec106d074cbbfd17052f77
a0126baf86a4cdd25abca8c48c9fdb42
c840d8f434a02d73f15b45d451d68d57
27925457f2da84350fba1f77e44130d1
246a4efd6658e00044a5bfc8e16eb8f2

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

bmfit.exe_1372:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

%Documents and Settings%\All Users\Application Data\bmfit.exe

%Documents and Settings%\All Users\Application Data\bmfit.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL