Backdoor.Win32.CosmicDuke_1276d0aa5a

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

winpdb.exe:332

The Backdoor injects its code into the following process(es):

%original file name%.exe:328
cmswdm.exe:1356

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:328 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\winpdb.exe (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
%System%\cmswdm.exe (7675 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
%Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
%System%\srvinf.exe (8009 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
%WinDir%\Tasks\Watchmon Service.job (290 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)

The process cmswdm.exe:1356 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7 (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7 (0 bytes)

Registry activity

The process winpdb.exe:332 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C B7 02 8F C2 B0 4B 07 93 50 95 12 E8 DF 23 B2"

The process %original file name%.exe:328 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"BitNames" = " WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\JavaSoft]
"Supplement" = "22 00 43 00 3A 00 5C 00 57 00 49 00 4E 00 44 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\WAB\WAB4\Wab File Name]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\WAB\WAB4]
"OlkFolderRefresh" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"BitNames" = " DOT11_ASSOCIATE DOT11_ROAMING DOT11_1X DOT11_PNP DOT11_SCAN DOT11_RECEIVE DOT11_SEND DOT11_IOCTL DOT11_OID DOT11_MISC DOT11_UPCALL DOT11_KEYMGR DOT11_PEER DOT11_SOFTAP DOT11_PAM DOT11_REPEATER DOT11_APROUTER DOT11_WME DOT11_CONFIG DOT11_MSM DOT11_MSM_ADAPT DOT11_MSM_SCAN DOT11_MSM_CONNECT DOT11_MSM_SECURITY_PKT DOT11_NOTIFY_OBJECT"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}]
"Identity Ordinal" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"Guid" = "d905ac1c-65e7-4242-99ea-fe66a8355df8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"Guid" = "2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"

[HKCU\Identities]
"Identity Ordinal" = "2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"BitNames" = " DOT11_AUTOCONF DOT11_AUTOCONF_CLIENT DOT11_AUTOCONF_UI DOT11_FATMSM DOT11_COMMON DOT11_WLANGPA DOT11_CLASS_COINSTALLER"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 65 EF 3D 4D CF 21 97 66 D6 14 47 2C CD 8E F3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"Guid" = "0c5a3172-2248-44fd-b9a6-8389cb1dc56a"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"BitNames" = " WD_LOG_FLAG_INIT WD_LOG_FLAG_RPC WD_LOG_FLAG_EVENT WD_LOG_FLAG_INTERFACE WD_LOG_FLAG_CONNECTION WD_LOG_FLAG_CONTROL WD_LOG_FLAG_LOCKS WD_LOG_FLAG_MEMORY WD_LOG_FLAG_REFERENCES WD_LOG_FLAG_FUNCTION_TRACE WD_LOG_FLAG_ASSERT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"BitNames" = " SECHC_LOG_FLAG_ASSERT SECHC_LOG_FLAG_INIT SECHC_LOG_FLAG_DIAG SECHC_LOG_FLAG_ONEX_DIAG SECHC_LOG_FLAG_REPAIR SECHC_LOG_FLAG_STATE SECHC_LOG_FLAG_EXT SECHC_LOG_FLAG_EVENT_LOG SECHC_LOG_FLAG_FUNCTION SECHC_LOG_FLAG_MEMORY SECHC_LOG_FLAG_LOCKS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"

[HKCU\Software\Microsoft\WAB\WAB4]
"OlkContactRefresh" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"Guid" = "6da4ddca-0901-4bae-9ad4-7e6030bab531"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"Guid" = "637a0f36-dff5-4b2f-83dd-b106c1c725e2"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Identities]
"Changing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

[HKCU\Identities]
"OutgoingID"
"IncomingID"

The process cmswdm.exe:1356 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F B9 EB 6C 0B D4 76 4E 54 67 CF CD FF 2D 79 38"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\NetworkService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\NetworkService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

Dropped PE files

MD5	File path
492756a2e8ccc85b6db827b3da975985	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\apisql.exe
17d000479b93ea97277164ab0e97f99d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\tapidsp.exe
b59199877e0d68a5e93fc8ea76374ed1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\mgrhost.exe
5098efd4fdc5fd591c65f9d850e07b30	c:\WINDOWS\system32\cmswdm.exe
eed550d95c90cd155288a2e609d37288	c:\WINDOWS\system32\winpdb.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   winpdb.exe:332
   

2. Delete the original Backdoor file.
   
3. Delete or disinfect the following files created/modified by the Backdoor:

   %Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %System%\winpdb.exe (194 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
   %System%\cmswdm.exe (7675 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
   %Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
   %System%\srvinf.exe (8009 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
   %WinDir%\Tasks\Watchmon Service.job (290 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
   %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)
   %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
   %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
   %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
   %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: NVIDIA Corporation
Product Name: NVIDIA Update Components
Product Version: 1.5.20.0
Legal Copyright: (C) NVIDIA Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WLMerger.exe
Internal Name: WLMerger
File Version: 1.5.20.0
File Description: WLMerger Application
Comments:
Language: Chinese (Simplified, PRC)

Company Name: NVIDIA CorporationProduct Name: NVIDIA Update ComponentsProduct Version: 1.5.20.0Legal Copyright: (C) NVIDIA Corporation. All rights reserved.Legal Trademarks: Original Filename: WLMerger.exeInternal Name: WLMergerFile Version: 1.5.20.0File Description: WLMerger ApplicationComments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	136669	136704	4.55502	1625282d8e32880dcd64cf0d83d477c1
.rdata	143360	25436	25600	3.34715	7da2f39fc2e605b68d02fb73d4804721
.data	172032	1587268	530432	1.98944	48dcab11fabcb0c8bdd4435691adbf71
.rsrc	1761280	4082	4096	2.31339	9088c985e60466a1c6ecf3698c760444

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
0e7dff2fbb12d94fb08ac78d58e5219c

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Backdoor connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_328_rwx_00400000_00020000:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

PSSSSSSh

PSSSSSSh

PSSSSSSh#

PSSSSSSh#

PSSSSSSh"

PSSSSSSh"

SSj%S

SSj%S

SSh|fB

SSh|fB

t$

t$

%original file name%.exe_328_rwx_00420000_00020000:

F%D,3

F%D,3

.mixcrt

.mixcrt

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

kernel32.dll

kernel32.dll

operator

operator

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

NetGetJoinInformation

NetGetJoinInformation

FtpOpenFileW

FtpOpenFileW

FtpSetCurrentDirectoryW

FtpSetCurrentDirectoryW