Trojan.DownLoader11.22088

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /tray
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /firewall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /silentinstall
'<SYSTEM32>\sysfiles\RMS.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /firewall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /silentinstall

Executes the following:

'<SYSTEM32>\ping.exe' 127.0.0.1
'<SYSTEM32>\msiexec.exe' /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 241B52BBC0633C81D7152FDC5122A7AD M Global\MSI0000
'<SYSTEM32>\msiexec.exe' -Embedding F815A8B60596F4A48147F5B2175846F3
'<SYSTEM32>\msiexec.exe' /I "rms.server5.1b1ru.msi" /qn
'<SYSTEM32>\msiexec.exe' /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.bat" "
'<SYSTEM32>\wscript.exe' "%TEMP%\stop.js"
'<SYSTEM32>\chcp.com' 1251
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
'<SYSTEM32>\attrib.exe' +s +h +r "%WINDIR%/system32/sysfiles/RMS.exe"

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Remote Manipulator System - Server\RIPCServer.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\HookDrv.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisDecoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcp90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcr90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\EULA.rtf
%PROGRAM_FILES%\Remote Manipulator System - Server\English.lg
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe
<SYSTEM32>\RWLN.dll
%WINDIR%\Installer\MSI8.tmp
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe
%WINDIR%\Installer\MSI6.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\help.chm
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8decoder.dll
%TEMP%\7ZipSfx.000\install.cmd
%TEMP%\7ZipSfx.000\rms.server5.1b1ru.msi
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\31790.msi
<SYSTEM32>\sysfiles\RMS.exe
%TEMP%\install.bat
%TEMP%\stop.js
%TEMP%\7ZSfx000.cmd
%TEMP%\RMS.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisEncoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8encoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\Russian.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\RWLN.dll
%WINDIR%\Installer\MSI1.tmp
%TEMP%\~3.tmp
%WINDIR%\Installer\MSI5.tmp
C:\Config.Msi\31793.rbs