Trojan.MulDrop26.29929

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im KsDumperClient.exe
'<SYSTEM32>\taskkill.exe' /f /im Dbg32.exe
'<SYSTEM32>\taskkill.exe' /f /im Dbg64.exe
'<SYSTEM32>\taskkill.exe' /f /im Ida64.exe
'<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
'<SYSTEM32>\taskkill.exe' /f /im x32dbg.exe
'<SYSTEM32>\taskkill.exe' /f /im x64dbg.exe
'<SYSTEM32>\taskkill.exe' /f /im OllyDbg.exe
'<SYSTEM32>\taskkill.exe' /f /im HTTP Debugger Windows Service (32 bit).exe
'<SYSTEM32>\taskkill.exe' /f /im cheatengine-i386.exe
'<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-i386.exe
'<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
'<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64-SSE4-AVX2.exe
'<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64.exe
'<SYSTEM32>\taskkill.exe' /f /im Cheat Engine.exe
'<SYSTEM32>\taskkill.exe' /f /im de4dot.exe
'<SYSTEM32>\taskkill.exe' /f /im Xenos32.exe
'<SYSTEM32>\taskkill.exe' /f /im Xenos.exe
'<SYSTEM32>\taskkill.exe' /f /im Xenos64.exe
'<SYSTEM32>\taskkill.exe' /f /im FiddlerEverywhere.exe
'<SYSTEM32>\taskkill.exe' /f /im Fiddler.exe
'<SYSTEM32>\taskkill.exe' /f /im Wireshark.exe
'<SYSTEM32>\taskkill.exe' /f /im idaq64.exe
'<SYSTEM32>\taskkill.exe' /f /im idaq.exe
'<SYSTEM32>\taskkill.exe' /f /im ProcessHacker.exe
'<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerSvc.exe
'<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerUI.exe
'<SYSTEM32>\taskkill.exe' /f /im KsDumper.exe
'<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
'<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T

Searches for windows to

detect analytical utilities:

ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'RegmonClass', WindowName: ''
ClassName: 'PROCEXPL', WindowName: ''
ClassName: '', WindowName: 'The Wireshark Network Analyzer'
ClassName: 'OLLYDBG', WindowName: ''

Modifies file system

Creates the following files

nul
%WINDIR%\temp\tarb23e.tmp
%WINDIR%\temp\cabb23d.tmp
%WINDIR%\temp\tar9bcf.tmp
%WINDIR%\temp\cab9bce.tmp
%WINDIR%\temp\tar9b8e.tmp
%WINDIR%\temp\cab9b7e.tmp
%WINDIR%\temp\tar9b2f.tmp
%WINDIR%\temp\cabb2db.tmp
%WINDIR%\temp\cab9b2e.tmp
%WINDIR%\temp\cab9a9f.tmp
%WINDIR%\temp\tar8403.tmp
%WINDIR%\temp\cab8402.tmp
%WINDIR%\temp\tar8393.tmp
%WINDIR%\temp\cab8392.tmp
%WINDIR%\temp\tar6c5a.tmp
%WINDIR%\temp\cab6c3a.tmp
%WINDIR%\temp\tar9aa0.tmp
%WINDIR%\temp\tarb2dc.tmp

Deletes the following files

%WINDIR%\temp\cab6c3a.tmp
%WINDIR%\temp\tarb23e.tmp
%WINDIR%\temp\cabb23d.tmp
%WINDIR%\temp\tar9bcf.tmp
%WINDIR%\temp\cab9bce.tmp
%WINDIR%\temp\tar9b8e.tmp
%WINDIR%\temp\cab9b7e.tmp
%WINDIR%\temp\tar9b2f.tmp
%WINDIR%\temp\cab9b2e.tmp
%WINDIR%\temp\tar9aa0.tmp
%WINDIR%\temp\cab9a9f.tmp
%WINDIR%\temp\tar8403.tmp
%WINDIR%\temp\cab8402.tmp
%WINDIR%\temp\tar8393.tmp
%WINDIR%\temp\cab8392.tmp
%WINDIR%\temp\tar6c5a.tmp
%WINDIR%\temp\cabb2db.tmp
%WINDIR%\temp\tarb2dc.tmp

Network activity

Connects to

'localhost':49186
'localhost':49188
'ke##uth.win':443

TCP

Other

'localhost':49186
'localhost':49188
'localhost':49189
'ke##uth.win':443

UDP

DNS ASK ke##uth.win

Miscellaneous

Searches for the following windows

ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'ollydbg.exe' WindowName: ''
ClassName: 'ImmunityDebugger' WindowName: ''
ClassName: 'IDA v7.0.170914' WindowName: ''
ClassName: 'dnSpy' WindowName: ''
ClassName: 'Progress Telerik Fiddler Web Debugger' WindowName: ''
ClassName: 'FolderChangesView.exe' WindowName: ''
ClassName: 'KsDumper.exe' WindowName: ''
ClassName: 'The Wireshark Network Analyzer' WindowName: ''
ClassName: 'KsDumper' WindowName: ''
ClassName: 'idaq64.exe' WindowName: ''
ClassName: 'Cheat Engine.exe' WindowName: ''
ClassName: 'cheatengine-i386.exe' WindowName: ''
ClassName: 'MugenJinFuu-x86_64.exe' WindowName: ''
ClassName: 'MugenJinFuu-i386.exe' WindowName: ''
ClassName: 'x64dbg' WindowName: ''
ClassName: 'Dump-Fixer.exe' WindowName: ''
ClassName: '' WindowName: 'OllyDbg - [CPU]'
ClassName: 'Fiddler.exe' WindowName: ''
ClassName: 'x64dbg.exe' WindowName: ''
ClassName: 'radare2.exe' WindowName: ''
ClassName: 'ImmunityDebugger.exe' WindowName: ''
ClassName: 'PETools.exe' WindowName: ''
ClassName: 'LordPE.exe' WindowName: ''
ClassName: 'Vmwareuser.exe' WindowName: ''
ClassName: 'Mugen JinFuu.exe' WindowName: ''
ClassName: 'kdstinker.exe' WindowName: ''
ClassName: 'HookExplorer.exe' WindowName: ''
ClassName: 'dumpcap.exe' WindowName: ''
ClassName: 'proc_analyzer.exe' WindowName: ''
ClassName: 'sysAnalyzer.exe' WindowName: ''
ClassName: 'windbg.exe' WindowName: ''
ClassName: 'sniff_hit.exe' WindowName: ''
ClassName: 'createdump.exe' WindowName: ''
ClassName: 'HTTPDebuggerSvc.exe' WindowName: ''
ClassName: 'MugenJinFuu-x86_64-SSE4-AVX2.exe' WindowName: ''
ClassName: '' WindowName: 'idaq64'
ClassName: '' WindowName: 'x64dbg'
ClassName: '' WindowName: 'Progress Telerik Fiddler Web Debugger'
ClassName: '' WindowName: 'MugenJinFuu-x86_64.exe'
ClassName: '' WindowName: 'MugenJinFuu-x86_64-SSE4-AVX2.exe'
ClassName: '' WindowName: 'Mugen JinFuu.exe'
ClassName: '' WindowName: 'MugenJinFuu-i386.exe'
ClassName: '' WindowName: 'KsDumper'
ClassName: '' WindowName: 'cheatengine-x86_64-SSE4-AVX2.exe'
ClassName: 'XTPMainFrame' WindowName: ''
ClassName: 'dbgviewClass' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'WdcWindow' WindowName: 'Resource Monitor'
ClassName: '' WindowName: 'ida64'
ClassName: 'Cheat Engine' WindowName: ''
ClassName: '' WindowName: 'Fiddler Everywhere'
ClassName: 'cheatengine-x86_64-SSE4-AVX2.exe' WindowName: ''
ClassName: 'cheatengine-x86_64.exe' WindowName: ''
ClassName: 'ida64.exe' WindowName: ''
ClassName: 'IDA64' WindowName: ''
ClassName: 'IDA' WindowName: ''
ClassName: 'WinDbgFrameClass' WindowName: ''
ClassName: 'ida.exe' WindowName: ''
ClassName: '' WindowName: 'IDA v7.0.170914'
ClassName: '' WindowName: 'HTTP Debugger'
ClassName: '' WindowName: 'HTTP Debugger (32bits)'
ClassName: '' WindowName: 'FolderChangesView'
ClassName: '' WindowName: 'Fiddler.WebUi'
ClassName: '' WindowName: 'Dumpcap'
ClassName: '' WindowName: 'Wireshark'
ClassName: '' WindowName: 'dnSpy'
ClassName: '' WindowName: 'Immunity Debugger - [CPU]'

Executes the following

'<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumperClient.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im x64dbg.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im x32dbg.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Ida64.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg64.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg32.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
'<SYSTEM32>\cmd.exe' /c cls
'<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
'<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
'<SYSTEM32>\find.exe' /i /v "md5"
'<SYSTEM32>\find.exe' /i /v "certutil"
'<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
'<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im OllyDbg.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im ProcessHacker.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq64.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Wireshark.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
'<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Fiddler.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos32.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im de4dot.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Cheat Engine.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumper.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos64.exe >nul 2>&1
'<SYSTEM32>\timeout.exe' /t 5

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней