Trojan.DownLoader9.15256

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'MZђ' = '"%APPDATA%\MZђ\MZђ.exe" /MODE=RUNONCE /DYNAMIC=MZђ'

Malicious functions:

Creates and executes the following:

'%TEMP%\nse2.tmp\nsE.tmp' WMIC OS Get OsLanguage /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\nsD.tmp' WMIC OS Get OsArchitecture /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\nsF.tmp' WMIC OS Get Version /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\ns11.tmp' "<SYSTEM32>\cscript.exe" //NoLogo "%TEMP%\nse2.tmp\av.vbs"
'%TEMP%\nse2.tmp\ns10.tmp' WMIC OS Get WindowsDirectory /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\nsC.tmp' WMIC OS Get InstallDate /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\ns3.tmp' WMIC OS Get SerialNumber /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\MZђ.exe' /MODE=INSTALL /RESET=FALSE /DYNAMIC=MZђ
'%TEMP%\nse2.tmp\ns9.tmp' WMIC OS Get SerialNumber /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\nsB.tmp' WMIC OS Get CSName /FORMAT:textvaluelist.xsl
'%TEMP%\nse2.tmp\nsA.tmp' WMIC OS Get Caption /FORMAT:textvaluelist.xsl

Executes the following:

'<SYSTEM32>\wbem\wmic.exe' OS Get Version /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get OsLanguage /FORMAT:textvaluelist.xsl
'<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\nse2.tmp\av.vbs"
'<SYSTEM32>\wbem\wmic.exe' OS Get WindowsDirectory /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get OsArchitecture /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get Caption /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get SerialNumber /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get InstallDate /FORMAT:textvaluelist.xsl
'<SYSTEM32>\wbem\wmic.exe' OS Get CSName /FORMAT:textvaluelist.xsl

Modifies file system :

Creates the following files:

%TEMP%\nse2.tmp\nsB.tmp
%TEMP%\nse2.tmp\nsA.tmp
%TEMP%\nse2.tmp\nsC.tmp
<SYSTEM32>\wbem\Logs\WMIC.LOG
%TEMP%\nse2.tmp\nsD.tmp
%TEMP%\nse2.tmp\ns9.tmp
%TEMP%\tmp8.tmp
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pop_request[2].php
<Current directory>\TempWmicBatchFile.bat
%TEMP%\nse2.tmp\nsE.tmp
%TEMP%\nse2.tmp\nsWeb.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\harvester[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pop_request[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pop_request[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\CAZQORBH.php
%TEMP%\nse2.tmp\ns11.tmp
%TEMP%\nse2.tmp\ns10.tmp
%TEMP%\nse2.tmp\nsF.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pop_request[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\harvester[1].php
%TEMP%\nse2.tmp\av.vbs
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pop_request[1].php
%APPDATA%\MZђ\MZђ.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\harvester[1].php
%TEMP%\nse2.tmp\registry.dll
%TEMP%\nse2.tmp\nsExec.dll
%TEMP%\nse2.tmp\MZђ.exe
%TEMP%\nse2.tmp\tmp_13242.txt
%TEMP%\nse2.tmp\System.dll
%TEMP%\nse2.tmp\IpConfig.dll
%TEMP%\nse2.tmp\UserInfo.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\requestid[1].php
%TEMP%\nse2.tmp\inetc.dll
%TEMP%\nse2.tmp\ns3.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pop_request[1].php
%TEMP%\nsb5.tmp\inetc.dll
%TEMP%\nsb5.tmp\request.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pop_request[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pop_request[1].php
%TEMP%\tmp7.tmp
%TEMP%\tmp6.tmp
%TEMP%\nsb5.tmp\IpConfig.dll
%TEMP%\nsb5.tmp\System.dll
%TEMP%\nsb5.tmp\ThreadTimer.dll
%TEMP%\nsb5.tmp\UserInfo.dll

Deletes the following files:

%TEMP%\nse2.tmp\nsE.tmp
%TEMP%\nse2.tmp\nsF.tmp
%TEMP%\nse2.tmp\nsC.tmp
%TEMP%\nse2.tmp\nsD.tmp
%TEMP%\nse2.tmp\ns11.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pop_request[1].php
%TEMP%\nse2.tmp\ns10.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pop_request[1].php
%TEMP%\nse2.tmp\nsB.tmp
%TEMP%\tmp7.tmp
%TEMP%\tmp8.tmp
%TEMP%\tmp6.tmp
%TEMP%\nsb5.tmp\request.txt
%TEMP%\nse2.tmp\ns9.tmp
%TEMP%\nse2.tmp\nsA.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pop_request[1].php
%TEMP%\nse2.tmp\ns3.tmp

Network activity:

Connects to:

'localhost':1040
'ht##.###dyhddownload.com':80

TCP:

HTTP GET requests:

ht##.###dyhddownload.com/harvester.php?ap############################################################################################
ht##.###dyhddownload.com/harvester.php?ap###############################################################################################
ht##.###dyhddownload.com/installer/pop_request.php?dy##################################
ht##.###dyhddownload.com/installer/requestid.php?ui#######
ht##.###dyhddownload.com/harvester.php?ap###################################################################################

UDP: