Trojan.DownLoader12.32945

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%TEMP%\ash.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

C:\RCX34.tmp
<Current directory>\ncYa.exe
<Current directory>\GmYg.ico
<Current directory>\JwQo.ico
<Current directory>\LmUQ.ico
C:\RCX35.tmp
<Current directory>\wQEa.exe
C:\RCX33.tmp
<Current directory>\tcIE.ico
C:\RCX31.tmp
<Current directory>\hgIY.exe
<Current directory>\hgMS.exe
<Current directory>\wgwk.exe
<Current directory>\Syko.ico
C:\RCX32.tmp
C:\RCX39.tmp
<Current directory>\cMkY.exe
<Current directory>\hEkA.ico
<Current directory>\ywAo.ico
<Current directory>\GIEE.ico
C:\RCX3A.tmp
<Current directory>\VccY.exe
C:\RCX38.tmp
<Current directory>\QUAA.ico
C:\RCX36.tmp
<Current directory>\TIEo.exe
<Current directory>\fAwM.exe
<Current directory>\OEQQ.exe
<Current directory>\kkEM.ico
C:\RCX37.tmp
C:\RCX2A.tmp
<Current directory>\iUsS.exe
<Current directory>\GWck.ico
<Current directory>\cQIA.ico
<Current directory>\eEIA.ico
C:\RCX2B.tmp
<Current directory>\CwcA.exe
C:\RCX29.tmp
<Current directory>\MOco.ico
C:\RCX27.tmp
<Current directory>\QYkM.exe
<Current directory>\ncYy.exe
<Current directory>\NIEg.exe
<Current directory>\wkcQ.ico
C:\RCX28.tmp
C:\RCX2F.tmp
<Current directory>\dcUG.exe
<Current directory>\eKYg.ico
<Current directory>\EkwE.ico
<Current directory>\hqAI.ico
C:\RCX30.tmp
<Current directory>\hgcW.exe
C:\RCX2E.tmp
<Current directory>\tEUk.ico
C:\RCX2C.tmp
<Current directory>\LQsU.exe
<Current directory>\Yoos.exe
<Current directory>\iMUw.exe
<Current directory>\KmQw.ico
C:\RCX2D.tmp
<Current directory>\DIAY.exe
<Current directory>\tisk.ico
C:\RCX48.tmp
<Current directory>\Zcgk.exe
<Current directory>\ZwgY.exe
<Current directory>\bkMc.exe
<Current directory>\feAA.ico
C:\RCX49.tmp
<Current directory>\WMgM.ico
<Current directory>\cAIe.exe
<Current directory>\UeUw.ico
C:\RCX45.tmp
C:\RCX46.tmp
C:\RCX47.tmp
<Current directory>\JYQQ.exe
<Current directory>\eWkk.ico
<Current directory>\VGYs.ico
C:\RCX4D.tmp
<Current directory>\DsUe.exe
<Current directory>\MMkk.exe
<Current directory>\TsEq.exe
<Current directory>\poAQ.ico
C:\RCX4E.tmp
<Current directory>\Wwgg.ico
<Current directory>\oMQU.exe
<Current directory>\qEEQ.ico
C:\RCX4A.tmp
C:\RCX4B.tmp
C:\RCX4C.tmp
<Current directory>\OcgA.exe
<Current directory>\HcwA.ico
<Current directory>\SIkk.ico
C:\RCX3E.tmp
<Current directory>\vUIm.exe
<Current directory>\kMUi.exe
<Current directory>\EMse.exe
<Current directory>\kiUc.ico
C:\RCX3F.tmp
<Current directory>\lsQs.ico
<Current directory>\qoIC.exe
<Current directory>\DUAc.ico
C:\RCX3B.tmp
C:\RCX3C.tmp
C:\RCX3D.tmp
<Current directory>\qcoq.exe
<Current directory>\ToYg.ico
<Current directory>\oOkA.ico
C:\RCX43.tmp
<Current directory>\KAUA.exe
<Current directory>\hkAo.exe
<Current directory>\CAMA.exe
<Current directory>\qoUo.ico
C:\RCX44.tmp
<Current directory>\gWsY.ico
<Current directory>\Usgu.exe
<Current directory>\UcUo.ico
C:\RCX40.tmp
C:\RCX41.tmp
C:\RCX42.tmp
<Current directory>\zYYa.exe
<Current directory>\IEQY.ico
<Current directory>\BuwM.ico
<Current directory>\emUU.ico
C:\RCXB.tmp
<Current directory>\wQkq.exe
<Current directory>\bUUC.exe
<Current directory>\YQIY.exe
<Current directory>\TIcY.ico
C:\RCXC.tmp
<Current directory>\uUQM.ico
<Current directory>\HQoM.exe
<Current directory>\uoEk.ico
C:\RCX8.tmp
C:\RCX9.tmp
C:\RCXA.tmp
<Current directory>\EIMG.exe
<Current directory>\YQkU.ico
<Current directory>\bEgo.ico
C:\RCX10.tmp
<Current directory>\lkAS.exe
<Current directory>\xcgw.exe
<Current directory>\Yswg.exe
<Current directory>\FGwI.ico
C:\RCX11.tmp
<Current directory>\FYsQ.ico
<Current directory>\JoMe.exe
<Current directory>\HOMY.ico
C:\RCXD.tmp
C:\RCXE.tmp
C:\RCXF.tmp
<Current directory>\Ccsc.exe
<Current directory>\CSEs.ico
<Current directory>\zQgg.ico
C:\RCX1.tmp
<Current directory>\UYAK.exe
<Current directory>\MAYw.exe
<Current directory>\zAUW.exe
<Current directory>\aqQQ.ico
C:\RCX2.tmp
%TEMP%\ash.exe
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
%HOMEPATH%\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\casg.txt
<Current directory>\cwsk.ico
%TEMP%\lCcAIkQw.bat
C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
<Current directory>\pywc.ico
C:\RCX6.tmp
<Current directory>\pAIM.exe
<Current directory>\uEEM.exe
<Current directory>\Pcsu.exe
<Current directory>\EwcQ.ico
C:\RCX7.tmp
<Current directory>\Rukw.ico
<Current directory>\IIcQ.exe
<Current directory>\uKgw.ico
C:\RCX3.tmp
C:\RCX4.tmp
C:\RCX5.tmp
<Current directory>\fEMG.exe
<Current directory>\zooU.ico
C:\RCX12.tmp
<Current directory>\rosa.exe
<Current directory>\nwQg.ico
C:\RCX1F.tmp
C:\RCX20.tmp
C:\RCX21.tmp
<Current directory>\skQW.exe
<Current directory>\kGUU.ico
<Current directory>\xoYK.exe
C:\RCX1D.tmp
<Current directory>\jYwA.exe
<Current directory>\Sygo.ico
<Current directory>\pMAk.ico
<Current directory>\KCAc.ico
C:\RCX1E.tmp
<Current directory>\hkAI.exe
<Current directory>\yAAe.exe
<Current directory>\eCEY.ico
C:\RCX24.tmp
C:\RCX25.tmp
C:\RCX26.tmp
<Current directory>\GcQq.exe
<Current directory>\rGcY.ico
<Current directory>\jMYK.exe
C:\RCX22.tmp
<Current directory>\lkAK.exe
<Current directory>\QGIQ.ico
<Current directory>\GKwk.ico
<Current directory>\Yegg.ico
C:\RCX23.tmp
<Current directory>\YUEi.exe
<Current directory>\OAcY.exe
<Current directory>\UMAw.ico
C:\RCX15.tmp
C:\RCX16.tmp
C:\RCX17.tmp
<Current directory>\mIsO.exe
<Current directory>\uiAc.ico
<Current directory>\ewos.exe
C:\RCX13.tmp
<Current directory>\NMEq.exe
<Current directory>\HSsI.ico
<Current directory>\DSoo.ico
<Current directory>\piIk.ico
C:\RCX14.tmp
<Current directory>\EoMW.exe
<Current directory>\cMcy.exe
<Current directory>\mAUk.ico
C:\RCX1A.tmp
C:\RCX1B.tmp
C:\RCX1C.tmp
<Current directory>\FMMc.exe
<Current directory>\gQwk.ico
<Current directory>\Hwwo.exe
C:\RCX18.tmp
<Current directory>\pgQA.exe
<Current directory>\DMUg.ico
<Current directory>\yeQI.ico
<Current directory>\OcwE.ico
C:\RCX19.tmp
<Current directory>\tMcS.exe

Deletes the following files:

<Current directory>\wQEa.exe
<Current directory>\GmYg.ico
<Current directory>\TIEo.exe
<Current directory>\JwQo.ico
<Current directory>\ncYa.exe
<Current directory>\tcIE.ico
<Current directory>\hgMS.exe
<Current directory>\Syko.ico
<Current directory>\wgwk.exe
<Current directory>\LmUQ.ico
<Current directory>\VccY.exe
<Current directory>\hEkA.ico
<Current directory>\DIAY.exe
<Current directory>\ywAo.ico
<Current directory>\cMkY.exe
<Current directory>\QUAA.ico
<Current directory>\fAwM.exe
<Current directory>\kkEM.ico
<Current directory>\OEQQ.exe
<Current directory>\hqAI.ico
<Current directory>\CwcA.exe
<Current directory>\GWck.ico
<Current directory>\LQsU.exe
<Current directory>\cQIA.ico
<Current directory>\iUsS.exe
<Current directory>\MOco.ico
<Current directory>\ncYy.exe
<Current directory>\wkcQ.ico
<Current directory>\NIEg.exe
<Current directory>\eEIA.ico
<Current directory>\hgcW.exe
<Current directory>\eKYg.ico
<Current directory>\hgIY.exe
<Current directory>\EkwE.ico
<Current directory>\dcUG.exe
<Current directory>\tEUk.ico
<Current directory>\Yoos.exe
<Current directory>\KmQw.ico
<Current directory>\iMUw.exe
<Current directory>\WMgM.ico
<Current directory>\Zcgk.exe
<Current directory>\tisk.ico
<Current directory>\ZwgY.exe
<Current directory>\eWkk.ico
<Current directory>\cAIe.exe
<Current directory>\qoUo.ico
<Current directory>\JYQQ.exe
<Current directory>\UeUw.ico
<Current directory>\bkMc.exe
<Current directory>\Wwgg.ico
<Current directory>\DsUe.exe
<Current directory>\VGYs.ico
<Current directory>\MMkk.exe
<Current directory>\HcwA.ico
<Current directory>\oMQU.exe
<Current directory>\feAA.ico
<Current directory>\OcgA.exe
<Current directory>\qEEQ.ico
<Current directory>\CAMA.exe
<Current directory>\lsQs.ico
<Current directory>\vUIm.exe
<Current directory>\SIkk.ico
<Current directory>\kMUi.exe
<Current directory>\ToYg.ico
<Current directory>\qoIC.exe
<Current directory>\GIEE.ico
<Current directory>\qcoq.exe
<Current directory>\DUAc.ico
<Current directory>\EMse.exe
<Current directory>\gWsY.ico
<Current directory>\KAUA.exe
<Current directory>\oOkA.ico
<Current directory>\hkAo.exe
<Current directory>\IEQY.ico
<Current directory>\Usgu.exe
<Current directory>\kiUc.ico
<Current directory>\zYYa.exe
<Current directory>\UcUo.ico
<Current directory>\BuwM.ico
<Current directory>\TIcY.ico
<Current directory>\YQIY.exe
<Current directory>\HOMY.ico
<Current directory>\JoMe.exe
<Current directory>\emUU.ico
<Current directory>\wQkq.exe
<Current directory>\YQkU.ico
<Current directory>\bUUC.exe
<Current directory>\uUQM.ico
<Current directory>\Ccsc.exe
<Current directory>\FGwI.ico
<Current directory>\Yswg.exe
<Current directory>\HSsI.ico
<Current directory>\NMEq.exe
<Current directory>\bEgo.ico
<Current directory>\lkAS.exe
<Current directory>\CSEs.ico
<Current directory>\xcgw.exe
<Current directory>\FYsQ.ico
<Current directory>\EIMG.exe
<Current directory>\aqQQ.ico
<Current directory>\zAUW.exe
<Current directory>\uKgw.ico
<Current directory>\IIcQ.exe
<Current directory>\zQgg.ico
<Current directory>\UYAK.exe
%TEMP%\lCcAIkQw.bat
<Current directory>\MAYw.exe
<Current directory>\cwsk.ico
<Current directory>\fEMG.exe
<Current directory>\EwcQ.ico
<Current directory>\Pcsu.exe
<Current directory>\uoEk.ico
<Current directory>\HQoM.exe
<Current directory>\pywc.ico
<Current directory>\pAIM.exe
<Current directory>\zooU.ico
<Current directory>\uEEM.exe
<Current directory>\Rukw.ico
<Current directory>\skQW.exe
<Current directory>\nwQg.ico
<Current directory>\lkAK.exe
<Current directory>\kGUU.ico
<Current directory>\rosa.exe
<Current directory>\pMAk.ico
<Current directory>\hkAI.exe
<Current directory>\KCAc.ico
<Current directory>\xoYK.exe
<Current directory>\QGIQ.ico
<Current directory>\GcQq.exe
<Current directory>\eCEY.ico
<Current directory>\QYkM.exe
<Current directory>\rGcY.ico
<Current directory>\yAAe.exe
<Current directory>\GKwk.ico
<Current directory>\YUEi.exe
<Current directory>\Yegg.ico
<Current directory>\jMYK.exe
<Current directory>\Sygo.ico
<Current directory>\mIsO.exe
<Current directory>\UMAw.ico
<Current directory>\pgQA.exe
<Current directory>\uiAc.ico
<Current directory>\OAcY.exe
<Current directory>\DSoo.ico
<Current directory>\EoMW.exe
<Current directory>\piIk.ico
<Current directory>\ewos.exe
<Current directory>\DMUg.ico
<Current directory>\FMMc.exe
<Current directory>\mAUk.ico
<Current directory>\jYwA.exe
<Current directory>\gQwk.ico
<Current directory>\cMcy.exe
<Current directory>\yeQI.ico
<Current directory>\tMcS.exe
<Current directory>\OcwE.ico
<Current directory>\Hwwo.exe

Moves the following files:

from C:\RCX34.tmp to <Current directory>\ncYa.exe
from C:\RCX35.tmp to <Current directory>\wQEa.exe
from C:\RCX32.tmp to <Current directory>\hgMS.exe
from C:\RCX33.tmp to <Current directory>\wgwk.exe
from C:\RCX36.tmp to <Current directory>\TIEo.exe
from C:\RCX39.tmp to <Current directory>\cMkY.exe
from C:\RCX3A.tmp to <Current directory>\VccY.exe
from C:\RCX37.tmp to <Current directory>\fAwM.exe
from C:\RCX38.tmp to <Current directory>\OEQQ.exe
from C:\RCX31.tmp to <Current directory>\hgIY.exe
from C:\RCX2A.tmp to <Current directory>\iUsS.exe
from C:\RCX2B.tmp to <Current directory>\CwcA.exe
from C:\RCX28.tmp to <Current directory>\ncYy.exe
from C:\RCX29.tmp to <Current directory>\NIEg.exe
from C:\RCX2C.tmp to <Current directory>\LQsU.exe
from C:\RCX2F.tmp to <Current directory>\dcUG.exe
from C:\RCX30.tmp to <Current directory>\hgcW.exe
from C:\RCX2D.tmp to <Current directory>\Yoos.exe
from C:\RCX2E.tmp to <Current directory>\iMUw.exe
from C:\RCX3B.tmp to <Current directory>\DIAY.exe
from C:\RCX48.tmp to <Current directory>\Zcgk.exe
from C:\RCX49.tmp to <Current directory>\ZwgY.exe
from C:\RCX46.tmp to <Current directory>\cAIe.exe
from C:\RCX47.tmp to <Current directory>\JYQQ.exe
from C:\RCX4A.tmp to <Current directory>\bkMc.exe
from C:\RCX4D.tmp to <Current directory>\DsUe.exe
from C:\RCX4E.tmp to <Current directory>\MMkk.exe
from C:\RCX4B.tmp to <Current directory>\oMQU.exe
from C:\RCX4C.tmp to <Current directory>\OcgA.exe
from C:\RCX45.tmp to <Current directory>\CAMA.exe
from C:\RCX3E.tmp to <Current directory>\vUIm.exe
from C:\RCX3F.tmp to <Current directory>\kMUi.exe
from C:\RCX3C.tmp to <Current directory>\qoIC.exe
from C:\RCX3D.tmp to <Current directory>\qcoq.exe
from C:\RCX40.tmp to <Current directory>\EMse.exe
from C:\RCX43.tmp to <Current directory>\KAUA.exe
from C:\RCX44.tmp to <Current directory>\hkAo.exe
from C:\RCX41.tmp to <Current directory>\Usgu.exe
from C:\RCX42.tmp to <Current directory>\zYYa.exe
from C:\RCXD.tmp to <Current directory>\YQIY.exe
from C:\RCXE.tmp to <Current directory>\JoMe.exe
from C:\RCXB.tmp to <Current directory>\wQkq.exe
from C:\RCXC.tmp to <Current directory>\bUUC.exe
from C:\RCXF.tmp to <Current directory>\Ccsc.exe
from C:\RCX12.tmp to <Current directory>\Yswg.exe
from C:\RCX13.tmp to <Current directory>\NMEq.exe
from C:\RCX10.tmp to <Current directory>\lkAS.exe
from C:\RCX11.tmp to <Current directory>\xcgw.exe
from C:\RCXA.tmp to <Current directory>\EIMG.exe
from C:\RCX3.tmp to <Current directory>\zAUW.exe
from C:\RCX4.tmp to <Current directory>\IIcQ.exe
from C:\RCX1.tmp to <Current directory>\UYAK.exe
from C:\RCX2.tmp to <Current directory>\MAYw.exe
from C:\RCX5.tmp to <Current directory>\fEMG.exe
from C:\RCX8.tmp to <Current directory>\Pcsu.exe
from C:\RCX9.tmp to <Current directory>\HQoM.exe
from C:\RCX6.tmp to <Current directory>\pAIM.exe
from C:\RCX7.tmp to <Current directory>\uEEM.exe
from C:\RCX14.tmp to <Current directory>\EoMW.exe
from C:\RCX21.tmp to <Current directory>\skQW.exe
from C:\RCX22.tmp to <Current directory>\lkAK.exe
from C:\RCX1F.tmp to <Current directory>\xoYK.exe
from C:\RCX20.tmp to <Current directory>\rosa.exe
from C:\RCX23.tmp to <Current directory>\YUEi.exe
from C:\RCX26.tmp to <Current directory>\GcQq.exe
from C:\RCX27.tmp to <Current directory>\QYkM.exe
from C:\RCX24.tmp to <Current directory>\jMYK.exe
from C:\RCX25.tmp to <Current directory>\yAAe.exe
from C:\RCX1E.tmp to <Current directory>\hkAI.exe
from C:\RCX17.tmp to <Current directory>\mIsO.exe
from C:\RCX18.tmp to <Current directory>\pgQA.exe
from C:\RCX15.tmp to <Current directory>\ewos.exe
from C:\RCX16.tmp to <Current directory>\OAcY.exe
from C:\RCX19.tmp to <Current directory>\tMcS.exe
from C:\RCX1C.tmp to <Current directory>\FMMc.exe
from C:\RCX1D.tmp to <Current directory>\jYwA.exe
from C:\RCX1A.tmp to <Current directory>\Hwwo.exe
from C:\RCX1B.tmp to <Current directory>\cMcy.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'AcIcUcAM.exe'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'jaQEcQMQ.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней