Trojan.DownLoader25.22535

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'ASMAgent' = '%ProgramFiles%\Asset Services Management\ASMAgent.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ASMAgent] 'ImagePath' = '%ProgramFiles%\Asset Services Management\ASMAgent.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\ASMAgent] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\Asset Services Management\ASMAgent.exe'
'%ProgramFiles%\Asset Services Management\ASMAgent.exe' -INSTALL -QUIET
'%TEMP%\ASM1.tmp\ASMSetup.exe'

Executes the following:

'<SYSTEM32>\ntvdm.exe' -f -i1

Modifies file system:

Creates the following files:

%ProgramFiles%\Asset Services Management\ASMBeacon.dll
%ProgramFiles%\Asset Services Management\ASMAgent.exe
%ProgramFiles%\Asset Services Management\ASMExcl.sys
%ProgramFiles%\Asset Services Management\ASMSMBIOS.tmp
%ProgramFiles%\Asset Services Management\ASMIncl.sys
%TEMP%\ASM1.tmp\ASMEXP.DAT
%TEMP%\ASM1.tmp\VisualParse.DLL
%TEMP%\ASM1.tmp\smartvsd.vxd
%TEMP%\ASM1.tmp\W95ws2setup.exe
%TEMP%\ASM1.tmp\VTCPUP20.EXE
%TEMP%\ASM1.tmp\VIPUP20.EXE
%ProgramFiles%\Asset Services Management\ASMUtils31.dll
C:\AsmFlag.sys
%ProgramFiles%\Asset Services Management\Inventory.W2K
%WINDIR%\Temp\scs2.tmp
%ProgramFiles%\Asset Services Management\SMBIOS.DAT
%WINDIR%\Temp\scs3.tmp
%ProgramFiles%\Asset Services Management\VisualParse.dll
%ProgramFiles%\Asset Services Management\HTTPParser31.dll
%ProgramFiles%\Asset Services Management\ClassLibrary31.dll
%ProgramFiles%\Asset Services Management\IncludeExclude.dll
%ProgramFiles%\Asset Services Management\Msvcrt.dll
%ProgramFiles%\Asset Services Management\Inventory.dll
%TEMP%\ASM1.tmp\ASMIncl.sys
%TEMP%\ASM1.tmp\ASMFlag.sys
%TEMP%\ASM1.tmp\ASMPayload.dll
%TEMP%\ASM1.tmp\ASMSMBIOS.tmp
%TEMP%\ASM1.tmp\ASMSetup.exe
%TEMP%\ASM1.tmp\ASMExcl.sys
%TEMP%\ASM1.tmp\extract.tmp
%TEMP%\ASM1.tmp\ASMCMD.DAT
%TEMP%\ASM1.tmp\asmsetup.ini
%TEMP%\ASM1.tmp\ASMBeacon.DLL
%TEMP%\ASM1.tmp\ASMAgent.EXE
%TEMP%\ASM1.tmp\ASMUtils31.DLL
%TEMP%\ASM1.tmp\Inventory.W9X
%TEMP%\ASM1.tmp\Inventory.W2K
%TEMP%\ASM1.tmp\Inventory.WNT
%TEMP%\ASM1.tmp\SControl.dll
%TEMP%\ASM1.tmp\MSVCRT.DLL
%TEMP%\ASM1.tmp\Inventory.DLL
%TEMP%\ASM1.tmp\CDEVA32.DLL
%TEMP%\ASM1.tmp\CDEVA16.DLL
%TEMP%\ASM1.tmp\ClassLibrary31.DLL
%TEMP%\ASM1.tmp\IncludeExclude.dll
%TEMP%\ASM1.tmp\HTTPParser31.DLL

Deletes the following files:

%TEMP%\ASM1.tmp\Inventory.DLL
%TEMP%\ASM1.tmp\IncludeExclude.dll
%TEMP%\ASM1.tmp\Inventory.W9X
%TEMP%\ASM1.tmp\Inventory.W2K
%TEMP%\ASM1.tmp\CDEVA32.DLL
%TEMP%\ASM1.tmp\CDEVA16.DLL
%TEMP%\ASM1.tmp\HTTPParser31.DLL
%TEMP%\ASM1.tmp\ClassLibrary31.DLL
%TEMP%\ASM1.tmp\W95ws2setup.exe
%TEMP%\ASM1.tmp\VisualParse.DLL
%TEMP%\ASM1.tmp\VTCPUP20.EXE
%TEMP%\ASM1.tmp\VIPUP20.EXE
%TEMP%\ASM1.tmp\MSVCRT.DLL
%TEMP%\ASM1.tmp\Inventory.WNT
%TEMP%\ASM1.tmp\smartvsd.vxd
%TEMP%\ASM1.tmp\SControl.dll
%TEMP%\ASM1.tmp\ASMEXP.DAT
%TEMP%\ASM1.tmp\ASMCMD.DAT
%TEMP%\ASM1.tmp\ASMAgent.EXE
%TEMP%\ASM1.tmp\asmsetup.ini
%WINDIR%\Temp\scs2.tmp
%TEMP%\ASM1.tmp\extract.tmp
%ProgramFiles%\Asset Services Management\SMBIOS.DAT
%WINDIR%\Temp\scs3.tmp
%TEMP%\ASM1.tmp\ASMSetup.exe
%TEMP%\ASM1.tmp\ASMPayload.dll
%TEMP%\ASM1.tmp\ASMUtils31.DLL
%TEMP%\ASM1.tmp\ASMSMBIOS.tmp
%TEMP%\ASM1.tmp\ASMExcl.sys
%TEMP%\ASM1.tmp\ASMBeacon.DLL
%TEMP%\ASM1.tmp\ASMIncl.sys
%TEMP%\ASM1.tmp\ASMFlag.sys

Moves the following files:

from %ProgramFiles%\Asset Services Management\Inventory.W2K to %ProgramFiles%\Asset Services Management\Inventory.exe
from %ProgramFiles%\Asset Services Management\ASMSMBIOS.tmp to %ProgramFiles%\Asset Services Management\ASMSMBIOS.EXE

Substitutes the following files: