Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'ASMAgent' = '%ProgramFiles%\Asset Services Management\ASMAgent.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ASMAgent] 'ImagePath' = '%ProgramFiles%\Asset Services Management\ASMAgent.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\ASMAgent] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\Asset Services Management\ASMAgent.exe'
- '%ProgramFiles%\Asset Services Management\Register.exe'
- '%TEMP%\ASM1.tmp\ASMSetup.exe'
- '%ProgramFiles%\Asset Services Management\ASMAgent.exe' -INSTALL -QUIET
Modifies file system:
Creates the following files:
- %ProgramFiles%\Asset Services Management\ASMAgent.exe
- %ProgramFiles%\Asset Services Management\ASMIncl.sys
- %ProgramFiles%\Asset Services Management\ASMExcl.sys
- %ProgramFiles%\Asset Services Management\ClassLibrary31.dll
- %ProgramFiles%\Asset Services Management\ASMUtils31.dll
- %ProgramFiles%\Asset Services Management\ASMBeacon.dll
- %TEMP%\ASM1.tmp\msvcr80.dll
- %TEMP%\ASM1.tmp\Register.exe
- %TEMP%\ASM1.tmp\VisualParse.DLL
- %TEMP%\ASM1.tmp\ASMEXP.DAT
- %TEMP%\ASM1.tmp\KillRegister.exe
- %TEMP%\ASM1.tmp\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Asset Services Management\HTTPParser31.dll
- %ProgramFiles%\Asset Services Management\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Asset Services Management\Inventory.W2K
- %ProgramFiles%\Asset Services Management\Register.exe
- C:\Asmflag.sys
- C:\agentlog.txt
- %ProgramFiles%\Asset Services Management\Microsoft.VC80.CRT\msvcr80.dll
- %ProgramFiles%\Asset Services Management\Msvcr80.dll
- %ProgramFiles%\Asset Services Management\Inventory.dll
- %ProgramFiles%\Asset Services Management\IncludeExclude.dll
- %ProgramFiles%\Asset Services Management\asmmemory.dll
- %ProgramFiles%\Asset Services Management\ASMMemoryDriver.sys
- %ProgramFiles%\Asset Services Management\VisualParse.dll
- %TEMP%\ASM1.tmp\ASMMemoryDriver.sys
- %TEMP%\ASM1.tmp\asmmemory.dll
- %TEMP%\ASM1.tmp\ASMIncl.sys
- %TEMP%\ASM1.tmp\asmsetup.ini
- %TEMP%\ASM1.tmp\ASMSetup.exe
- %TEMP%\ASM1.tmp\ASMPayload.dll
- %TEMP%\ASM1.tmp\ASMAgent.EXE
- %TEMP%\ASM1.tmp\extract.tmp
- %TEMP%\ASM1.tmp\ASMCMD.DAT
- %TEMP%\ASM1.tmp\ASMFlag.sys
- %TEMP%\ASM1.tmp\ASMExcl.sys
- %TEMP%\ASM1.tmp\ASMBeacon.DLL
- %TEMP%\ASM1.tmp\ASMUtils31.DLL
- %TEMP%\ASM1.tmp\Inventory.W9X
- %TEMP%\ASM1.tmp\Inventory.W2K
- %TEMP%\ASM1.tmp\Inventory.DLL
- %TEMP%\ASM1.tmp\SControl.dll
- %TEMP%\ASM1.tmp\Inventory.x64
- %TEMP%\ASM1.tmp\Inventory.WNT
- %TEMP%\ASM1.tmp\ClassLibrary31.DLL
- %TEMP%\ASM1.tmp\CDEVA32.DLL
- %TEMP%\ASM1.tmp\CDEVA16.DLL
- %TEMP%\ASM1.tmp\IncludeExclude.dll
- %TEMP%\ASM1.tmp\HTTPParser31.DLL
- %TEMP%\ASM1.tmp\ClassLibrary3164.DLL
Deletes the following files:
- %TEMP%\ASM1.tmp\ASMEXP.DAT
- %TEMP%\ASM1.tmp\ASMCMD.DAT
- %TEMP%\ASM1.tmp\extract.tmp
Moves the following files:
- from %ProgramFiles%\Asset Services Management\Inventory.W2K to %ProgramFiles%\Asset Services Management\Inventory.exe
Substitutes the following files:
- %TEMP%\ASM1.tmp\extract.tmp
Network activity:
Connects to:
- 'li####eren.asap.com':80
- '<L####NET>.170.1':80
UDP:
- DNS ASK li####eren.asap.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ASMMONITOR' WindowName: 'ASMMonitor'
