Trojan.DownLoader46.33051

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\ialdnwxf] 'ImagePath' = '<Current directory>\superec.ProcessMemory.sys'

Creates the following services

'ialdnwxf' <Current directory>\\superec.ProcessMemory.sys
'ialdnwxf' <Current directory>\superec.ProcessMemory.sys

Modifies file system

Creates the following files

<Current directory>\superec.processmemory.sys
%WINDIR%\temp\udd781c.tmp
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Deletes the following files

%WINDIR%\temp\udd781c.tmp

Network activity

Connects to

'hi.##idu.com':80
's8.##res2.com':80
'js.####port.qihucdn.com':80
'pu##.###nzhang.baidu.com':80
'ai###.#lszyht.net.cn':80
'im#.#v123.com':443
'oc##.##ust-provider.cn':80
'hm.##idu.com':443
's.##0.cn':80
'38.##.230.148':668
'ca###.#itongzixun.com':80
's.###syht.cn':443
'hu###omains.com':443
'yy##.net':80
'wm##8.com':80
'mh##.com':80
'in####ow.baidu.com':443
'ca####.sitongzixun.com':80
'ap#.##are.baidu.com':80

TCP

HTTP GET requests

http://hi.##idu.com/new/xjp0595
http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQD%2BidmAsdKY1ntjjJmIabA9
http://ai###.#lszyht.net.cn/module/simplepicbackground/1740215/3449/6896246_1533524453.png?t=###
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_03/tmp1543818545_1797647_s.png
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357581_1797647_s.jpg
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357499_1797647_s.jpg
http://js.####port.qihucdn.com/11.0.1.js?a9##############################
http://s8.##res2.com/static/ab77b6ea7f3fbf79.js
http://www.yy##.net/template/danye/phone.jpg
http://s.##0.cn/so/zz.gif?ur###########################################################################################################
http://ap#.##are.baidu.com/s.gif?l=#####################
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357659_1797647_s.jpg
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357638_1797647_s.jpg
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357688_1797647_s.jpg
http://ai###.#lszyht.net.cn/ev_user_module_content_tmp/2018_12_09/tmp1544357543_1797647_s.jpg
http://www.wm##8.com/tui.js
http://ca###.#itongzixun.com/image/phonered.png
http://38.##.230.148:668/https/picture/sjb.jpg via 38.##.230.148
http://38.##.230.148:668/https/css/index.css via 38.##.230.148
http://38.##.230.148:668/https/css/mobile.css via 38.##.230.148
http://ca####.sitongzixun.com/image/defaultlunbo.png?1=#
http://38.##.230.148:668/ via 38.##.230.148
http://www.yy##.net/template/img/jpy.gif
http://www.yy##.net/template/danye/default.png
http://pu##.###nzhang.baidu.com/push.js
http://www.wm##8.com/self_define/TJStyle.php?us######################################################
http://www.wm##8.com/ag.js
http://www.yy##.net/template/danye/css.css
http://www.wm##8.com/b.txt
http://www.yy##.net/
http://www.wm##8.com/
http://www.mh##.com/
http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQD7y1a%2F%2BA8SUfQ1uTWr9pmR
http://ai###.#lszyht.net.cn/tj/public_pic/loading-wait-bg.gif