Susp_Dropper (Kaspersky), MemScan:Backdoor.Agent.ZQA (B) (Emsisoft), MemScan:Backdoor.Agent.ZQA (AdAware), GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Backdoor, Worm, EmailWorm, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: d7e154972b5da73013da6a16ba6adada
SHA1: 2e270d762b6ddec1fbb07cf683b63f6deb412f1c
SHA256: 00357d00e7e5418496a35d573665b0b2257e91d0371358a876fb65d7a9a37bb9
SSDeep: 1536:m3rJJyVemDdYBK7xmrhhXzNozBTCXv3GgX:CWDdYBKWNBowN
Size: 60928 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The MemScan creates the following process(es):
%original file name%.exe:1856
dwwin.exe:456
The MemScan injects its code into the following process(es):
biiqrzr.cmd:560
File activity
The process biiqrzr.cmd:560 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%System%\WindowsUpdt.exe (19 bytes)
The process %original file name%.exe:1856 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%WinDir%\xwrm.exe (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iirqar.arqj.jay (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\728a_appcompat.txt (6214 bytes)
The process dwwin.exe:456 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EBEDUZMH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PFLAY7K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3UX696B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\77D5B.dmp (78539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I94FGPK1\desktop.ini (67 bytes)
Registry activity
The process biiqrzr.cmd:560 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 27 4F 3C DE 95 88 A6 5B 60 3A 52 92 36 A5 5E"
To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WihdowsUpdate" = "%System%\WindowsUpdt.exe"
The process %original file name%.exe:1856 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 EB C6 D1 5B 82 C0 19 14 B8 4A B7 ED FE 3C E0"
To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"
The MemScan deletes the following registry key(s):
[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
The MemScan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"
The process dwwin.exe:456 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 63 84 9F E3 E6 5D F2 81 8A 7A 18 AD 10 E7 9F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The MemScan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| f148630fc9161563166ed11bc5834096 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\iirqar.arqj.jay |
| aae37ad72f817dea8845ff32d16a8ba0 | c:\WINDOWS\system32\WindowsUpdt.exe |
| f148630fc9161563166ed11bc5834096 | c:\WINDOWS\xwrm.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1856
dwwin.exe:456 - Delete the original MemScan file.
- Delete or disinfect the following files created/modified by the MemScan:
%System%\WindowsUpdt.exe (19 bytes)
%WinDir%\xwrm.exe (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iirqar.arqj.jay (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\728a_appcompat.txt (6214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EBEDUZMH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PFLAY7K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3UX696B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\77D5B.dmp (78539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I94FGPK1\desktop.ini (67 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WihdowsUpdate" = "%System%\WindowsUpdt.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe" - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| aqbbaiyy | 4096 | 4096 | 1536 | 0.538676 | 82327e841e33f812885ad83c62919fdb |
| rjbijirb | 8192 | 57344 | 55296 | 4.84627 | 901ef36c1ce9d9ace382deb0aa8a9b59 |
| ayqajyyj | 65536 | 4096 | 512 | 0.468013 | dd766bd3556eda6b66f2d7b6ec1b0e21 |
| aryjqqay | 69632 | 4096 | 2048 | 4.10575 | 677f0a894d5ff2f6c088f025736ee3d8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
Strings from Dumps
%original file name%.exe_1856:
\xwrm.exe
\xwrm.exe
%WinDir%\xwrm.exe
%WinDir%\xwrm.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
USER %s 8 * :%s
USER %s 8 * :%s
NICK %s
NICK %s
PONG %s
PONG %s
JOIN #england
JOIN #england
PRIVMSG #england :.-:[X-Worm]:-.
PRIVMSG #england :.-:[X-Worm]:-.
irc.undernet.org
irc.undernet.org
MAIL FROM:<%s>
MAIL FROM:<%s>
RCPT TO:<%s>
RCPT TO:<%s>
--%s--
--%s--
From:<%s>
From:<%s>
To: %s
To: %s
Subject:%s
Subject:%s
boundary="%s"
boundary="%s"
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
charset="windows-1255"
charset="windows-1255"
name= "%s%s"
name= "%s%s"
Content-Disposition: attachment; filename="%s%s"
Content-Disposition: attachment; filename="%s%s"
Support
Support
No.reply
No.reply
8.txtt:
8.txtt:
8.htmt2
8.htmt2
8.rtft*
8.rtft*
8.doct"
8.doct"
8.bdxt
8.bdxt
8.phpt
8.phpt
8.jspt
8.jspt
8.cgit
8.cgit
smtp
smtp
ws2_32.dll
ws2_32.dll
ADVAPI32.DLL
ADVAPI32.DLL
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
User32.dll
User32.dll
fs_snap.exe
fs_snap.exe
arnsec.exe
arnsec.exe
ISABL~1.EXE
ISABL~1.EXE
8.exe
8.exe
8.scrtt
8.scrtt
8.avitJ
8.avitJ
8.doctB
8.doctB
8.mp3t:
8.mp3t:
8.mpgt2
8.mpgt2
8.xlst*
8.xlst*
8.jpgt"
8.jpgt"
8.zipt
8.zipt
8.isot
8.isot
8.pdft
8.pdft
8.pptt
8.pptt
8.rart
8.rart
D:\fs_snap.exe
D:\fs_snap.exe
SFC.DLL
SFC.DLL
Pajzaiy.yrar
Pajzaiy.yrar
D:\ajzaiy.yrar
D:\ajzaiy.yrar
ReadMe.exe
ReadMe.exe
c:\%original file name%.exe
c:\%original file name%.exe
131c346.exe
131c346.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iirqar.arqj.jay
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iirqar.arqj.jay
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj
biiqrzr.cmd
biiqrzr.cmd
.text
.text
.rsrc
.rsrc
gu>%uM
gu>%uM
~nt.ex
~nt.ex
CrToMaPh
CrToMaPh
hPRIVMSG %s :
hPRIVMSG %s :
kernel32.dll
kernel32.dll
.%suld nb
.%suld nb
KERNEL32.dll
KERNEL32.dll
2'3.3`3}3
2'3.3`3}3
0M1e1w1}1-2x2
0M1e1w1}1-2x2
biiqrzr.cmd_560:
.text
.text
.rsrc
.rsrc
\WindowsUpdt.exe
\WindowsUpdt.exe
irc.undernet.org
irc.undernet.org
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
InternetOpenUrlA
InternetOpenUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
url1.dat
url1.dat
PRIVMSG %s :Operations Stoped
PRIVMSG %s :Operations Stoped
PRIVMSG %s :Wasting %s
PRIVMSG %s :Wasting %s
PRIVMSG %s :Udp Floding %s
PRIVMSG %s :Udp Floding %s
-!udp_flood
-!udp_flood
PRIVMSG %s :%s Downloaded&executed
PRIVMSG %s :%s Downloaded&executed
1.exe
1.exe
-!download_exe
-!download_exe
PRIVMSG %s :Login Success
PRIVMSG %s :Login Success
-!login
-!login
PRIVMSG
PRIVMSG
%*s %s %*s %s %s %s
%*s %s %*s %s %s %s
MODE %s nsk %s
MODE %s nsk %s
JOIN %s %s
JOIN %s %s
PONG %s
PONG %s
NICK %s
NICK %s
USER %s 8 * :%s
USER %s 8 * :%s
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
2614211705
2614211705
D:\biiqrzr.cmd
D:\biiqrzr.cmd
kernel32.dll
kernel32.dll
.%suld nb
.%suld nb
biiqrzr.cmd_560_rwx_00401000_0000F000:
\WindowsUpdt.exe
\WindowsUpdt.exe
irc.undernet.org
irc.undernet.org
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
InternetOpenUrlA
InternetOpenUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
url1.dat
url1.dat
PRIVMSG %s :Operations Stoped
PRIVMSG %s :Operations Stoped
PRIVMSG %s :Wasting %s
PRIVMSG %s :Wasting %s
PRIVMSG %s :Udp Floding %s
PRIVMSG %s :Udp Floding %s
-!udp_flood
-!udp_flood
PRIVMSG %s :%s Downloaded&executed
PRIVMSG %s :%s Downloaded&executed
1.exe
1.exe
-!download_exe
-!download_exe
PRIVMSG %s :Login Success
PRIVMSG %s :Login Success
-!login
-!login
PRIVMSG
PRIVMSG
%*s %s %*s %s %s %s
%*s %s %*s %s %s %s
MODE %s nsk %s
MODE %s nsk %s
JOIN %s %s
JOIN %s %s
PONG %s
PONG %s
NICK %s
NICK %s
USER %s 8 * :%s
USER %s 8 * :%s
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
2614211705
2614211705
D:\biiqrzr.cmd
D:\biiqrzr.cmd
kernel32.dll
kernel32.dll
.%suld nb
.%suld nb