Trojan.Win32.Bumat_fc4d522d01

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

net1.exe:736
net1.exe:1376
%original file name%.exe:456
NET.exe:1816
NET.exe:204
fservice.exe:1360
coco1.exe:1812
HelpMe.exe:516

The Trojan injects its code into the following process(es):No processes have been created.

File activity

The process fservice.exe:1360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\services.exe (2105 bytes)
%WinDir%\system\sservice.exe (2105 bytes)

The Trojan deletes the following file(s):

%System%\fservice.exe (0 bytes)
%WinDir%\system\sservice.exe (0 bytes)

The process coco1.exe:1812 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\HelpMe.exe (3262 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF215A.tmp (0 bytes)
%System%\HelpMe.exe (0 bytes)

The process HelpMe.exe:516 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\HelpMe.exe.bat (101 bytes)
%System%\fservice.exe (2105 bytes)
%WinDir%\system\sservice.exe (2105 bytes)

Registry activity

The process net1.exe:736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 79 F1 0F 7B 6A 3C 0B 17 BA BF F3 F0 A0 D3 63"

The process net1.exe:1376 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 65 8F D8 02 61 22 4B 84 03 BF 25 16 33 A2 3A"

The process %original file name%.exe:456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 6F 19 62 DD 06 0C 7A C2 7C 81 AF 80 C0 64 3E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"coco1.exe" = "coco1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process NET.exe:1816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE B7 87 85 E1 D9 96 3E E9 8D 85 47 53 1D 6F A8"

The process NET.exe:204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 33 DF BD 7C DC 54 9D 3D 8A CD 20 92 3D 40 90"

The process fservice.exe:1360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 DD 30 7F 8F F0 68 9C 52 E4 C3 A0 1D AF 4E C8"

The process coco1.exe:1812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 36 08 FF 63 E3 83 09 5D 90 83 B8 C0 0C 40 D7"

The process HelpMe.exe:516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 2C D1 DC EC DF 97 32 DA 87 D2 9A 5C 62 6D B8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"DirectX For Microsoft® Windows" = "%System%\fservice.exe"

[HKCU\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings]
"ICQ_UIN" = ""
"LanNotifie" = ""

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}]
"StubPath" = "%WinDir%\system\sservice.exe"

[HKCU\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings]
"Bulas" = "1"
"Kurban_Ismi" = "whbuhl"
"XP_FW_Disable" = "1"
"XP_SYS_Recovery" = "1"
"Hata" = ""
"Port" = "4001"
"Sifre" = "032547"
"Mail" = "us`ihlnAx`inn/gs"
"ICQ_UIN2" = ""
"FW_KILL" = "1"

"Online_List" = "iuuq;..us`ihld/ushqne/bnl.bfh,cho.qsns`u/bfh"
"KSil" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "Explorer.exe %System%\fservice.exe"

Network activity (URLs)

URL	IP
hxxp://212.27.63.106/coco1.exe
hxxp://trahime.tripod.com/cgi-bin/prorat.cgi?bilgisayaradi=XP_&ipadresi=192.168.1.129&serverportu=5110&kurban=victim&servermodeli=V1.9:Fix-10&serversaati=2:51:34_AM&servertarihi=2/17/2014&serversifre=123456&islem=log	209.202.252.50
mx-eu.mail.am0.yahoodns.net	188.125.69.79

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   net1.exe:736
   net1.exe:1376
   %original file name%.exe:456
   NET.exe:1816
   NET.exe:204
   fservice.exe:1360
   coco1.exe:1812
   HelpMe.exe:516

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %WinDir%\services.exe (2105 bytes)
   %WinDir%\system\sservice.exe (2105 bytes)
   %System%\HelpMe.exe (3262 bytes)
   %System%\HelpMe.exe.bat (101 bytes)
   %System%\fservice.exe (2105 bytes)
   

4. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "Shell" = "Explorer.exe %System%\fservice.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps