Backdoor.Win32.Napolar.vn_bc14507891

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

{897da024-84c6-cb43-f92a-b6a6897da024}.exe:2596
{897da024-84c6-cb43-f92a-b6a6897da024}.exe:2504
%original file name%.exe:1248
%original file name%.exe:1724

The Backdoor injects its code into the following process(es):

Explorer.EXE:2080

File activity

The process %original file name%.exe:1248 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка\{897da024-84c6-cb43-f92a-b6a6897da024}.exe (170856 bytes)

Registry activity

The process {897da024-84c6-cb43-f92a-b6a6897da024}.exe:2596 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Startup" = "%Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка"

The process {897da024-84c6-cb43-f92a-b6a6897da024}.exe:2504 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Startup" = "%Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка"

The process %original file name%.exe:1248 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Startup" = "%Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка"

The process %original file name%.exe:1724 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Startup" = "%Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Backdoor installs the following user-mode hooks in WS2_32.dll:

send

The Backdoor installs the following user-mode hooks in ntdll.dll:

DbgUiRemoteBreakin
ZwSetValueKey
NtResumeThread
NtQueryDirectoryFile

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   {897da024-84c6-cb43-f92a-b6a6897da024}.exe:2596
   {897da024-84c6-cb43-f92a-b6a6897da024}.exe:2504
   %original file name%.exe:1248
   %original file name%.exe:1724
   

3. Delete the original Backdoor file.
   
4. Delete or disinfect the following files created/modified by the Backdoor:

   %Documents and Settings%\%current user%\Главное меню\Программы\Автозагрузка\{897da024-84c6-cb43-f92a-b6a6897da024}.exe (170856 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	8533	12288	3.45701	d7710c14dc529bea7e63831e55260e7d
.rdata	16384	4177	8192	2.0181	3be4f4fd23cc1ffbc8eee143db178abb
.data	24576	751	4096	0.372667	758b24e4ffba4fa0d1a1988b2f20fa0c
.rsrc	28672	4997	8192	3.02847	f73aa029f84e5f4474aa229864fdff66

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
yghqlyz.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps

Explorer.EXE_2080_rwx_01EA0000_0001A000:

0%D$!

0%D$!

URLM

URLM

CHROME.Aq

CHROME.Aq

OPERA

OPERA

PORTUTIL

PORTUTIL

C:\plug

C:\plug

in.bine

in.bine

form-url

form-url

01234567

01234567

\\.\pipe

\\.\pipe

v=%d.%

v=%d.%

d&u=%s&c

d&u=%s&c

=%s&h

=%s&h

http://

http://

%s HTTP/

%s HTTP/

t: %s

t: %s

pad.exe

pad.exe

olPort 9

olPort 9

fig.me/

fig.me/

.bin@2b

.bin@2b

C:\sw8i.t!

C:\sw8i.t!

z.com_

z.com_

URLMON

URLMON

CHROME.DLL

CHROME.DLL

OPERA.DLL

OPERA.DLL

RAPPORTUTIL

RAPPORTUTIL

C:\plugin.bin

C:\plugin.bin

\tor.bin

\tor.bin

HTTP/1.1

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

GET /?lX HTTP/1.1

GET /?lX HTTP/1.1

HOST: %s

HOST: %s

User-Agent: %s

User-Agent: %s

POST / HTTP/1.1

POST / HTTP/1.1

Content-Length: %d

Content-Length: %d

\\.\pipe\npSolar

\\.\pipe\npSolar

v=%d.%d&u=%s&c=%s&s=%s&w=%d.%d.%d&b=%d

v=%d.%d&u=%s&c=%s&s=%s&w=%d.%d.%d&b=%d