Trojan.DownLoader22.32820

Malicious functions:

Executes the following:

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name = "MiniThunderPlatform" dir = in action = allow program = "%TEMP%\is-E2CII.tmp\download\MiniThunderPlatform.exe" enable = yes
'%TEMP%\is-E2CII.tmp\download\MiniThunderPlatform.exe' -StartTP
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="MiniThunderPlatform"
'%TEMP%\is-FG32O.tmp\<Virus name>.tmp' /SL5="$30092,1901374,54272,<Full path to virus>"
'%TEMP%\is-E2CII.tmp\UCDlr.exe' /SL5=$

Modifies file system:

Creates the following files:

%TEMP%\is-E2CII.tmp\XLBugHandler.dll
%TEMP%\is-E2CII.tmp\XLBugReport.exe
%TEMP%\is-E2CII.tmp\msvcr71.dll
%TEMP%\is-E2CII.tmp\minizip.dll
%TEMP%\is-E2CII.tmp\msvcp71.dll
%ALLUSERSPROFILE%\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNjA=\Version_3_2_1_42\Profiles\asyn_frame.dat
%ALLUSERSPROFILE%\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNjA=\Version_3_2_1_42\Profiles\stat.dat
%ALLUSERSPROFILE%\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNjA=\Version_3_2_1_42\Profiles\error.dat
%TEMP%\is-E2CII.tmp\zlib1.dll
%ALLUSERSPROFILE%\Application Data\Thunder Network\DownloadLib\pub_store.dat
%TEMP%\is-E2CII.tmp\UCDlr.exe
%TEMP%\is-E2CII.tmp\xldl.dll
%TEMP%\is-E2CII.tmp\_isetup\_shfoldr.dll
%TEMP%\is-FG32O.tmp\<Virus name>.tmp
%TEMP%\is-E2CII.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-E2CII.tmp\id.dat
%TEMP%\is-E2CII.tmp\MiniThunderPlatform.exe
%TEMP%\is-E2CII.tmp\download_engine.dll
%TEMP%\is-E2CII.tmp\atl71.dll
%TEMP%\is-E2CII.tmp\dl_peer_id.dll

Sets the 'hidden' attribute to the following files:

Moves the following files:

from %TEMP%\is-E2CII.tmp\msvcr71.dll to %TEMP%\is-E2CII.tmp\download\msvcr71.dll
from %TEMP%\is-E2CII.tmp\msvcp71.dll to %TEMP%\is-E2CII.tmp\download\msvcp71.dll
from %TEMP%\is-E2CII.tmp\XLBugHandler.dll to %TEMP%\is-E2CII.tmp\download\XLBugHandler.dll
from %TEMP%\is-E2CII.tmp\zlib1.dll to %TEMP%\is-E2CII.tmp\download\zlib1.dll
from %TEMP%\is-E2CII.tmp\XLBugReport.exe to %TEMP%\is-E2CII.tmp\download\XLBugReport.exe
from %TEMP%\is-E2CII.tmp\minizip.dll to %TEMP%\is-E2CII.tmp\download\minizip.dll
from %TEMP%\is-E2CII.tmp\dl_peer_id.dll to %TEMP%\is-E2CII.tmp\download\dl_peer_id.dll
from %TEMP%\is-E2CII.tmp\atl71.dll to %TEMP%\is-E2CII.tmp\download\atl71.dll
from %TEMP%\is-E2CII.tmp\download_engine.dll to %TEMP%\is-E2CII.tmp\download\download_engine.dll
from %TEMP%\is-E2CII.tmp\MiniThunderPlatform.exe to %TEMP%\is-E2CII.tmp\download\MiniThunderPlatform.exe
from %TEMP%\is-E2CII.tmp\id.dat to %TEMP%\is-E2CII.tmp\download\id.dat

Network activity:

Connects to:

TCP:

HTTP POST requests:

http://xi###ingdou.com/anzhuang.aspx?OU##########################################################################################################################################################...

UDP: