Trojan.DownLoader12.32955

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%TEMP%\ashAvast.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

C:\RCX3A.tmp
<Current directory>\kQkA.ico
<Current directory>\pSIA.ico
<Current directory>\XIAw.exe
<Current directory>\MuYM.ico
<Current directory>\uYwo.exe
<Current directory>\ewoY.exe
C:\RCX3B.tmp
<Current directory>\iOwg.ico
<Current directory>\UUoi.exe
<Current directory>\IswM.exe
C:\RCX37.tmp
<Current directory>\GcQG.exe
C:\RCX39.tmp
C:\RCX38.tmp
<Current directory>\cYIE.ico
C:\RCX3C.tmp
<Current directory>\AMUe.exe
C:\RCX40.tmp
C:\RCX3F.tmp
<Current directory>\YiIQ.ico
C:\RCX41.tmp
<Current directory>\nCIA.ico
<Current directory>\EkQw.ico
<Current directory>\pAMS.exe
C:\RCX3D.tmp
<Current directory>\HGUU.ico
<Current directory>\TcYU.ico
<Current directory>\WMIe.exe
<Current directory>\hSgg.ico
<Current directory>\cIUC.exe
<Current directory>\dcYm.exe
C:\RCX3E.tmp
<Current directory>\psME.ico
<Current directory>\MsQw.exe
C:\RCX2F.tmp
C:\RCX2E.tmp
<Current directory>\EYIc.ico
C:\RCX30.tmp
<Current directory>\FkMA.ico
<Current directory>\FGMs.ico
<Current directory>\zMUw.exe
C:\RCX2C.tmp
<Current directory>\CqEY.ico
<Current directory>\iQEs.ico
<Current directory>\fcok.exe
<Current directory>\bAcM.ico
<Current directory>\REcM.exe
<Current directory>\wsoE.exe
C:\RCX2D.tmp
<Current directory>\wYkC.exe
<Current directory>\Dykw.ico
<Current directory>\wowo.exe
<Current directory>\Twky.exe
C:\RCX34.tmp
<Current directory>\skcc.exe
C:\RCX36.tmp
C:\RCX35.tmp
<Current directory>\VSsA.ico
<Current directory>\yYgC.exe
C:\RCX32.tmp
C:\RCX31.tmp
<Current directory>\MEMM.ico
C:\RCX33.tmp
<Current directory>\wUUQ.ico
<Current directory>\fcAM.ico
<Current directory>\XEYO.exe
<Current directory>\OocS.exe
<Current directory>\IYEu.exe
C:\RCX51.tmp
C:\RCX50.tmp
<Current directory>\AsAc.ico
C:\RCX52.tmp
<Current directory>\NMUY.ico
<Current directory>\JqEI.ico
<Current directory>\KEAG.exe
C:\RCX4E.tmp
<Current directory>\VSgo.ico
<Current directory>\jWQs.ico
<Current directory>\lYAw.exe
<Current directory>\TGwA.ico
<Current directory>\FUQW.exe
<Current directory>\wUsk.exe
C:\RCX4F.tmp
<Current directory>\iAYo.exe
<Current directory>\ZWkE.ico
<Current directory>\wMwg.exe
<Current directory>\acsG.exe
C:\RCX56.tmp
<Current directory>\WsUk.exe
C:\RCX58.tmp
C:\RCX57.tmp
<Current directory>\KKoQ.ico
<Current directory>\mswW.exe
C:\RCX54.tmp
C:\RCX53.tmp
<Current directory>\wOgU.ico
C:\RCX55.tmp
<Current directory>\cWog.ico
<Current directory>\RMYE.ico
<Current directory>\mQcg.exe
C:\RCX4D.tmp
<Current directory>\maQg.ico
<Current directory>\wMcW.exe
<Current directory>\OwgM.exe
C:\RCX45.tmp
<Current directory>\nMUA.exe
C:\RCX47.tmp
C:\RCX46.tmp
<Current directory>\EmQE.ico
<Current directory>\jsUG.exe
C:\RCX43.tmp
C:\RCX42.tmp
<Current directory>\RsQk.ico
C:\RCX44.tmp
<Current directory>\CWQY.ico
<Current directory>\OywI.ico
<Current directory>\zAgC.exe
<Current directory>\NsEE.ico
C:\RCX4B.tmp
<Current directory>\DowE.ico
<Current directory>\TAUc.ico
<Current directory>\xYgi.exe
<Current directory>\bGIg.ico
<Current directory>\WcIO.exe
<Current directory>\FAUC.exe
C:\RCX4C.tmp
<Current directory>\VgAY.ico
<Current directory>\lIMc.exe
<Current directory>\ucYO.exe
C:\RCX48.tmp
<Current directory>\OQso.exe
C:\RCX4A.tmp
C:\RCX49.tmp
<Current directory>\gwEI.ico
C:\RCX2B.tmp
<Current directory>\uIsu.exe
C:\RCXD.tmp
C:\RCXC.tmp
<Current directory>\TkcA.ico
C:\RCXE.tmp
<Current directory>\fIMQ.ico
<Current directory>\aewM.ico
<Current directory>\uUAC.exe
C:\RCXA.tmp
<Current directory>\QQwQ.ico
<Current directory>\Fkoo.ico
<Current directory>\TMQw.exe
<Current directory>\yOkM.ico
<Current directory>\wggm.exe
<Current directory>\bcws.exe
C:\RCXB.tmp
<Current directory>\XAwA.exe
<Current directory>\OQAY.ico
<Current directory>\tgIc.exe
<Current directory>\lEcu.exe
C:\RCX12.tmp
<Current directory>\vwAk.exe
C:\RCX14.tmp
C:\RCX13.tmp
<Current directory>\boUw.ico
<Current directory>\tYYm.exe
C:\RCX10.tmp
C:\RCXF.tmp
<Current directory>\xIgQ.ico
C:\RCX11.tmp
<Current directory>\zcYA.ico
<Current directory>\jWwk.ico
<Current directory>\JIgk.exe
C:\RCX9.tmp
<Current directory>\SMMM.ico
<Current directory>\ocQK.exe
<Current directory>\UkAs.exe
C:\RCX1.tmp
<Current directory>\roQO.exe
C:\RCX3.tmp
C:\RCX2.tmp
<Current directory>\jmIY.ico
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\casg.txt
%HOMEPATH%\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
%TEMP%\QYQIEoAg.bat
%TEMP%\ashAvast.exe
<Current directory>\TQgg.ico
C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
<Current directory>\QyUc.ico
C:\RCX7.tmp
<Current directory>\tUcc.ico
<Current directory>\uMUY.ico
<Current directory>\JcsU.exe
<Current directory>\ESMI.ico
<Current directory>\rAUe.exe
<Current directory>\ngAo.exe
C:\RCX8.tmp
<Current directory>\FCYk.ico
<Current directory>\XIAE.exe
<Current directory>\icQQ.exe
C:\RCX4.tmp
<Current directory>\bIEc.exe
C:\RCX6.tmp
C:\RCX5.tmp
<Current directory>\lywI.ico
<Current directory>\ZwAg.ico
<Current directory>\FeIo.ico
<Current directory>\jswM.exe
<Current directory>\MMsU.exe
C:\RCX23.tmp
<Current directory>\zYMG.exe
C:\RCX25.tmp
C:\RCX24.tmp
<Current directory>\EaQs.ico
<Current directory>\JoUM.exe
C:\RCX21.tmp
C:\RCX20.tmp
<Current directory>\tOok.ico
C:\RCX22.tmp
<Current directory>\ZIwA.ico
<Current directory>\QCAw.ico
<Current directory>\VEIy.exe
<Current directory>\Okww.ico
C:\RCX29.tmp
<Current directory>\AGko.ico
<Current directory>\dAok.ico
<Current directory>\IsEM.exe
<Current directory>\YIgM.ico
<Current directory>\PQYO.exe
<Current directory>\MIEs.exe
C:\RCX2A.tmp
<Current directory>\MSYg.ico
<Current directory>\UEgw.exe
<Current directory>\dkQE.exe
C:\RCX26.tmp
<Current directory>\yYsy.exe
C:\RCX28.tmp
C:\RCX27.tmp
<Current directory>\LmYA.ico
<Current directory>\rAAK.exe
C:\RCX18.tmp
<Current directory>\Rssw.ico
<Current directory>\jIMw.ico
<Current directory>\pEoS.exe
<Current directory>\jsoU.ico
<Current directory>\MsMM.exe
<Current directory>\LcEW.exe
C:\RCX19.tmp
<Current directory>\ieAE.ico
<Current directory>\ZwwM.exe
<Current directory>\WQUI.exe
C:\RCX15.tmp
<Current directory>\wYgA.exe
C:\RCX17.tmp
C:\RCX16.tmp
<Current directory>\zyQs.ico
C:\RCX1A.tmp
<Current directory>\Jggg.exe
C:\RCX1E.tmp
C:\RCX1D.tmp
<Current directory>\diMs.ico
C:\RCX1F.tmp
<Current directory>\RKEM.ico
<Current directory>\SMwM.ico
<Current directory>\VosM.exe
C:\RCX1B.tmp
<Current directory>\Ieok.ico
<Current directory>\zmow.ico
<Current directory>\lAow.exe
<Current directory>\QkwY.ico
<Current directory>\oMoQ.exe
<Current directory>\NAYE.exe
C:\RCX1C.tmp

Deletes the following files:

<Current directory>\pSIA.ico
<Current directory>\XIAw.exe
<Current directory>\ewoY.exe
<Current directory>\uYwo.exe
<Current directory>\kQkA.ico
<Current directory>\UUoi.exe
<Current directory>\psME.ico
<Current directory>\iOwg.ico
<Current directory>\cYIE.ico
<Current directory>\GcQG.exe
<Current directory>\MuYM.ico
<Current directory>\AMUe.exe
<Current directory>\hSgg.ico
<Current directory>\YiIQ.ico
<Current directory>\EkQw.ico
<Current directory>\pAMS.exe
<Current directory>\TcYU.ico
<Current directory>\WMIe.exe
<Current directory>\dcYm.exe
<Current directory>\cIUC.exe
<Current directory>\HGUU.ico
<Current directory>\IswM.exe
<Current directory>\EYIc.ico
<Current directory>\MsQw.exe
<Current directory>\zMUw.exe
<Current directory>\wYkC.exe
<Current directory>\FGMs.ico
<Current directory>\wsoE.exe
<Current directory>\iQEs.ico
<Current directory>\CqEY.ico
<Current directory>\bAcM.ico
<Current directory>\REcM.exe
<Current directory>\FkMA.ico
<Current directory>\wowo.exe
<Current directory>\wUUQ.ico
<Current directory>\Dykw.ico
<Current directory>\VSsA.ico
<Current directory>\skcc.exe
<Current directory>\MEMM.ico
<Current directory>\yYgC.exe
<Current directory>\XEYO.exe
<Current directory>\Twky.exe
<Current directory>\fcAM.ico
<Current directory>\OocS.exe
<Current directory>\TGwA.ico
<Current directory>\FUQW.exe
<Current directory>\IYEu.exe
<Current directory>\KEAG.exe
<Current directory>\AsAc.ico
<Current directory>\lYAw.exe
<Current directory>\bGIg.ico
<Current directory>\jWQs.ico
<Current directory>\VSgo.ico
<Current directory>\wUsk.exe
<Current directory>\JqEI.ico
<Current directory>\acsG.exe
<Current directory>\RMYE.ico
<Current directory>\cWog.ico
<Current directory>\ZWkE.ico
<Current directory>\wMwg.exe
<Current directory>\NMUY.ico
<Current directory>\iAYo.exe
<Current directory>\mswW.exe
<Current directory>\mQcg.exe
<Current directory>\wOgU.ico
<Current directory>\WcIO.exe
<Current directory>\CWQY.ico
<Current directory>\OwgM.exe
<Current directory>\wMcW.exe
<Current directory>\nMUA.exe
<Current directory>\maQg.ico
<Current directory>\jsUG.exe
<Current directory>\nCIA.ico
<Current directory>\RsQk.ico
<Current directory>\OywI.ico
<Current directory>\zAgC.exe
<Current directory>\EmQE.ico
<Current directory>\xYgi.exe
<Current directory>\gwEI.ico
<Current directory>\TAUc.ico
<Current directory>\DowE.ico
<Current directory>\FAUC.exe
<Current directory>\NsEE.ico
<Current directory>\ucYO.exe
<Current directory>\lIMc.exe
<Current directory>\OQso.exe
<Current directory>\VgAY.ico
<Current directory>\fcok.exe
<Current directory>\aewM.ico
<Current directory>\uUAC.exe
<Current directory>\XAwA.exe
<Current directory>\tYYm.exe
<Current directory>\fIMQ.ico
<Current directory>\wggm.exe
<Current directory>\QQwQ.ico
<Current directory>\yOkM.ico
<Current directory>\TkcA.ico
<Current directory>\uIsu.exe
<Current directory>\xIgQ.ico
<Current directory>\vwAk.exe
<Current directory>\OQAY.ico
<Current directory>\boUw.ico
<Current directory>\ZwAg.ico
<Current directory>\WQUI.exe
<Current directory>\jWwk.ico
<Current directory>\JIgk.exe
<Current directory>\lEcu.exe
<Current directory>\tgIc.exe
<Current directory>\zcYA.ico
<Current directory>\bcws.exe
<Current directory>\jmIY.ico
<Current directory>\roQO.exe
<Current directory>\icQQ.exe
<Current directory>\XIAE.exe
<Current directory>\QyUc.ico
<Current directory>\UkAs.exe
%TEMP%\QYQIEoAg.bat
<Current directory>\TQgg.ico
<Current directory>\SMMM.ico
<Current directory>\ocQK.exe
<Current directory>\FCYk.ico
<Current directory>\rAUe.exe
<Current directory>\tUcc.ico
<Current directory>\ESMI.ico
<Current directory>\Fkoo.ico
<Current directory>\TMQw.exe
<Current directory>\lywI.ico
<Current directory>\bIEc.exe
<Current directory>\JcsU.exe
<Current directory>\ngAo.exe
<Current directory>\uMUY.ico
<Current directory>\ZwwM.exe
<Current directory>\FeIo.ico
<Current directory>\jswM.exe
<Current directory>\zYMG.exe
<Current directory>\dkQE.exe
<Current directory>\EaQs.ico
<Current directory>\VEIy.exe
<Current directory>\tOok.ico
<Current directory>\QCAw.ico
<Current directory>\ZIwA.ico
<Current directory>\MMsU.exe
<Current directory>\Okww.ico
<Current directory>\MIEs.exe
<Current directory>\dAok.ico
<Current directory>\AGko.ico
<Current directory>\YIgM.ico
<Current directory>\PQYO.exe
<Current directory>\MSYg.ico
<Current directory>\UEgw.exe
<Current directory>\yYsy.exe
<Current directory>\IsEM.exe
<Current directory>\LmYA.ico
<Current directory>\JoUM.exe
<Current directory>\Rssw.ico
<Current directory>\LcEW.exe
<Current directory>\MsMM.exe
<Current directory>\lAow.exe
<Current directory>\jsoU.ico
<Current directory>\wYgA.exe
<Current directory>\ieAE.ico
<Current directory>\zyQs.ico
<Current directory>\jIMw.ico
<Current directory>\pEoS.exe
<Current directory>\zmow.ico
<Current directory>\VosM.exe
<Current directory>\diMs.ico
<Current directory>\SMwM.ico
<Current directory>\RKEM.ico
<Current directory>\rAAK.exe
<Current directory>\Ieok.ico
<Current directory>\NAYE.exe
<Current directory>\oMoQ.exe
<Current directory>\Jggg.exe
<Current directory>\QkwY.ico

Moves the following files:

from C:\RCX3B.tmp to <Current directory>\ewoY.exe
from C:\RCX3C.tmp to <Current directory>\uYwo.exe
from C:\RCX3A.tmp to <Current directory>\XIAw.exe
from C:\RCX38.tmp to <Current directory>\UUoi.exe
from C:\RCX39.tmp to <Current directory>\GcQG.exe
from C:\RCX40.tmp to <Current directory>\AMUe.exe
from C:\RCX41.tmp to <Current directory>\pAMS.exe
from C:\RCX3F.tmp to <Current directory>\cIUC.exe
from C:\RCX3D.tmp to <Current directory>\WMIe.exe
from C:\RCX3E.tmp to <Current directory>\dcYm.exe
from C:\RCX37.tmp to <Current directory>\IswM.exe
from C:\RCX30.tmp to <Current directory>\zMUw.exe
from C:\RCX31.tmp to <Current directory>\wYkC.exe
from C:\RCX2F.tmp to <Current directory>\MsQw.exe
from C:\RCX2D.tmp to <Current directory>\wsoE.exe
from C:\RCX2E.tmp to <Current directory>\REcM.exe
from C:\RCX35.tmp to <Current directory>\wowo.exe
from C:\RCX36.tmp to <Current directory>\skcc.exe
from C:\RCX34.tmp to <Current directory>\Twky.exe
from C:\RCX32.tmp to <Current directory>\yYgC.exe
from C:\RCX33.tmp to <Current directory>\XEYO.exe
from C:\RCX42.tmp to <Current directory>\OocS.exe
from C:\RCX51.tmp to <Current directory>\IYEu.exe
from C:\RCX52.tmp to <Current directory>\KEAG.exe
from C:\RCX50.tmp to <Current directory>\FUQW.exe
from C:\RCX4E.tmp to <Current directory>\lYAw.exe
from C:\RCX4F.tmp to <Current directory>\wUsk.exe
from C:\RCX56.tmp to <Current directory>\acsG.exe
from C:\RCX57.tmp to <Current directory>\wMwg.exe
from C:\RCX55.tmp to <Current directory>\mQcg.exe
from C:\RCX53.tmp to <Current directory>\iAYo.exe
from C:\RCX54.tmp to <Current directory>\mswW.exe
from C:\RCX4D.tmp to <Current directory>\WcIO.exe
from C:\RCX46.tmp to <Current directory>\wMcW.exe
from C:\RCX47.tmp to <Current directory>\nMUA.exe
from C:\RCX45.tmp to <Current directory>\OwgM.exe
from C:\RCX43.tmp to <Current directory>\jsUG.exe
from C:\RCX44.tmp to <Current directory>\zAgC.exe
from C:\RCX4B.tmp to <Current directory>\xYgi.exe
from C:\RCX4C.tmp to <Current directory>\FAUC.exe
from C:\RCX4A.tmp to <Current directory>\OQso.exe
from C:\RCX48.tmp to <Current directory>\ucYO.exe
from C:\RCX49.tmp to <Current directory>\lIMc.exe
from C:\RCX2C.tmp to <Current directory>\fcok.exe
from C:\RCXF.tmp to <Current directory>\XAwA.exe
from C:\RCX10.tmp to <Current directory>\tYYm.exe
from C:\RCXE.tmp to <Current directory>\uUAC.exe
from C:\RCXC.tmp to <Current directory>\wggm.exe
from C:\RCXD.tmp to <Current directory>\uIsu.exe
from C:\RCX14.tmp to <Current directory>\vwAk.exe
from C:\RCX15.tmp to <Current directory>\WQUI.exe
from C:\RCX13.tmp to <Current directory>\tgIc.exe
from C:\RCX11.tmp to <Current directory>\JIgk.exe
from C:\RCX12.tmp to <Current directory>\lEcu.exe
from C:\RCXB.tmp to <Current directory>\bcws.exe
from C:\RCX4.tmp to <Current directory>\icQQ.exe
from C:\RCX5.tmp to <Current directory>\XIAE.exe
from C:\RCX3.tmp to <Current directory>\roQO.exe
from C:\RCX1.tmp to <Current directory>\UkAs.exe
from C:\RCX2.tmp to <Current directory>\ocQK.exe
from C:\RCX9.tmp to <Current directory>\rAUe.exe
from C:\RCXA.tmp to <Current directory>\TMQw.exe
from C:\RCX8.tmp to <Current directory>\ngAo.exe
from C:\RCX6.tmp to <Current directory>\bIEc.exe
from C:\RCX7.tmp to <Current directory>\JcsU.exe
from C:\RCX16.tmp to <Current directory>\ZwwM.exe
from C:\RCX25.tmp to <Current directory>\zYMG.exe
from C:\RCX26.tmp to <Current directory>\dkQE.exe
from C:\RCX24.tmp to <Current directory>\jswM.exe
from C:\RCX22.tmp to <Current directory>\VEIy.exe
from C:\RCX23.tmp to <Current directory>\MMsU.exe
from C:\RCX2A.tmp to <Current directory>\MIEs.exe
from C:\RCX2B.tmp to <Current directory>\PQYO.exe
from C:\RCX29.tmp to <Current directory>\IsEM.exe
from C:\RCX27.tmp to <Current directory>\UEgw.exe
from C:\RCX28.tmp to <Current directory>\yYsy.exe
from C:\RCX21.tmp to <Current directory>\JoUM.exe
from C:\RCX1A.tmp to <Current directory>\MsMM.exe
from C:\RCX1B.tmp to <Current directory>\lAow.exe
from C:\RCX19.tmp to <Current directory>\LcEW.exe
from C:\RCX17.tmp to <Current directory>\wYgA.exe
from C:\RCX18.tmp to <Current directory>\pEoS.exe
from C:\RCX1F.tmp to <Current directory>\VosM.exe
from C:\RCX20.tmp to <Current directory>\rAAK.exe
from C:\RCX1E.tmp to <Current directory>\Jggg.exe
from C:\RCX1C.tmp to <Current directory>\NAYE.exe
from C:\RCX1D.tmp to <Current directory>\oMoQ.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'AcIcUcAM.exe'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'jaQEcQMQ.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней