Trojan.DownLoader24.38463

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Brightness Shadow Upgrade Auto Level Routing Power' = 'C:\ulehuwwed\ivlqzblhyvxi.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Helper Framework Policy Connect DCOM] 'ImagePath' = 'C:\ulehuwwed\ivlqzblhyvxi.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Helper Framework Policy Connect DCOM] 'Start' = '00000002'

Malicious functions:

Executes the following:

'C:\ulehuwwed\ryapsudzkh.exe' "c:\ulehuwwed\ivlqzblhyvxi.exe"
'C:\ulehuwwed\ivlqzblhyvxi.exe'
'C:\ulehuwwed\vokpt344wxujdjvwpcw.exe'

Modifies file system:

Creates the following files:

C:\ulehuwwed\ivlqzblhyvxi.exe
C:\ulehuwwed\ryapsudzkh.exe
C:\ulehuwwed\vokpt344wxujdjvwpcw.exe
%WINDIR%\ulehuwwed\orgqafvg
C:\ulehuwwed\orgqafvg

Sets the 'hidden' attribute to the following files:

C:\ulehuwwed\ryapsudzkh.exe
C:\ulehuwwed\ivlqzblhyvxi.exe

Deletes the following files:

C:\ulehuwwed\vokpt344wxujdjvwpcw.exe
%WINDIR%\ulehuwwed\orgqafvg

Network activity:

Connects to:

'ei###rwrite.net':80
'en####hwrite.net':80
'ei###rniece.net':80
'en####hniece.net':80
'fr###almost.net':80
'ex#####ncealmost.net':80
'ei####oclock.net':80
'en####hoclock.net':80
'en####hspeak.net':80
'fa###yniece.net':80
'ch####enwrite.net':80
'fa###yspeak.net':80
'ch####enniece.net':80
'fa####oclock.net':80
'ei###rspeak.net':80
'fa###ywrite.net':80
'ch####enoclock.net':80
'fr###reason.net':80
'ge####manvalue.net':80
'al####yvalue.net':80
'ge#####anorderly.net':80
'al####yorderly.net':80
'fo####reason.net':80
'me####reason.net':80
'fo####almost.net':80
'me####almost.net':80
'al####yreason.net':80
'ex#####nceorderly.net':80
'fr###value.net':80
'ex#####ncereason.net':80
'fr####rderly.net':80
'al####yalmost.net':80
'ge####manreason.net':80
'ex####encevalue.net':80
'ge####manalmost.net':80
'ch####enspeak.net':80
'wh####rspeak.net':80
'ri###speak.net':80
'su####oclock.net':80
'fo####noclock.net':80
'wh####rwrite.net':80
'ri###write.net':80
'wh####rniece.net':80
'ri###niece.net':80
'fo####nwrite.net':80
'ma####eoclock.net':80
'su###nspeak.net':80
'ma####ewrite.net':80
'pe####oclock.net':80
'fo####nniece.net':80
'su###nwrite.net':80
'fo####nspeak.net':80
'su###nniece.net':80
'wh####roclock.net':80
'pi####eniece.net':80
'ci####tteniece.net':80
'pi####espeak.net':80
'ci####ttespeak.net':80
'pi####eoclock.net':80
'ci####tteoclock.net':80
'pi####ewrite.net':80
'ci####ttewrite.net':80
'th####oclock.net':80
'th###hspeak.net':80
'fi###eniece.net':80
'ri###oclock.net':80
'fi###espeak.net':80
'th###hwrite.net':80
'fi####oclock.net':80
'th###hniece.net':80
'fi###ewrite.net':80

TCP:

HTTP GET requests:

http://ei###rwrite.net/index.php
http://en####hwrite.net/index.php
http://ei###rniece.net/index.php
http://en####hniece.net/index.php
http://fr###almost.net/index.php
http://ex#####ncealmost.net/index.php
http://ei####oclock.net/index.php
http://en####hoclock.net/index.php
http://en####hspeak.net/index.php
http://fa###yniece.net/index.php
http://ch####enwrite.net/index.php
http://fa###yspeak.net/index.php
http://ch####enniece.net/index.php
http://fa####oclock.net/index.php
http://ei###rspeak.net/index.php
http://fa###ywrite.net/index.php
http://ch####enoclock.net/index.php
http://fr###reason.net/index.php
http://ge####manvalue.net/index.php
http://al####yvalue.net/index.php
http://ge#####anorderly.net/index.php
http://al####yorderly.net/index.php
http://fo####reason.net/index.php
http://me####reason.net/index.php
http://fo####almost.net/index.php
http://me####almost.net/index.php
http://al####yreason.net/index.php
http://ex#####nceorderly.net/index.php
http://fr###value.net/index.php
http://ex#####ncereason.net/index.php
http://fr####rderly.net/index.php
http://al####yalmost.net/index.php
http://ge####manreason.net/index.php
http://ex####encevalue.net/index.php
http://ge####manalmost.net/index.php
http://ch####enspeak.net/index.php
http://wh####rspeak.net/index.php
http://ri###speak.net/index.php
http://su####oclock.net/index.php
http://fo####noclock.net/index.php
http://wh####rwrite.net/index.php
http://ri###write.net/index.php
http://wh####rniece.net/index.php
http://ri###niece.net/index.php
http://fo####nwrite.net/index.php
http://ma####eoclock.net/index.php
http://su###nspeak.net/index.php
http://ma####ewrite.net/index.php
http://pe####oclock.net/index.php
http://fo####nniece.net/index.php
http://su###nwrite.net/index.php
http://fo####nspeak.net/index.php
http://su###nniece.net/index.php
http://wh####roclock.net/index.php
http://pi####eniece.net/index.php
http://ci####tteniece.net/index.php
http://pi####espeak.net/index.php
http://ci####ttespeak.net/index.php
http://pi####eoclock.net/index.php
http://ci####tteoclock.net/index.php
http://pi####ewrite.net/index.php
http://ci####ttewrite.net/index.php
http://th####oclock.net/index.php
http://th###hspeak.net/index.php
http://fi###eniece.net/index.php
http://ri###oclock.net/index.php
http://fi###espeak.net/index.php
http://th###hwrite.net/index.php
http://fi####oclock.net/index.php
http://th###hniece.net/index.php
http://fi###ewrite.net/index.php

UDP:

DNS ASK ei###rwrite.net
DNS ASK en####hwrite.net
DNS ASK ei###rniece.net
DNS ASK en####hniece.net
DNS ASK ei####oclock.net
DNS ASK ex#####ncealmost.net
DNS ASK fr###reason.net
DNS ASK en####hoclock.net
DNS ASK fr###almost.net
DNS ASK fa###yniece.net
DNS ASK ch####enwrite.net
DNS ASK fa###yspeak.net
DNS ASK ch####enniece.net
DNS ASK fa###ywrite.net
DNS ASK ei###rspeak.net
DNS ASK en####hspeak.net
DNS ASK ch####enoclock.net
DNS ASK fa####oclock.net
DNS ASK ge####manvalue.net
DNS ASK al####yvalue.net
DNS ASK ge#####anorderly.net
DNS ASK al####yorderly.net
DNS ASK fo####almost.net
DNS ASK me####reason.net
DNS ASK fo####orderly.net
DNS ASK me####almost.net
DNS ASK fo####reason.net
DNS ASK ex#####nceorderly.net
DNS ASK fr###value.net
DNS ASK ex#####ncereason.net
DNS ASK fr####rderly.net
DNS ASK ex####encevalue.net
DNS ASK ge####manreason.net
DNS ASK al####yreason.net
DNS ASK ge####manalmost.net
DNS ASK al####yalmost.net
DNS ASK wh####rspeak.net
DNS ASK ri###speak.net
DNS ASK su####oclock.net
DNS ASK fo####noclock.net
DNS ASK wh####rniece.net
DNS ASK ri###write.net
DNS ASK wh####roclock.net
DNS ASK ri###niece.net
DNS ASK wh####rwrite.net
DNS ASK ma####eoclock.net
DNS ASK su###nspeak.net
DNS ASK ma####ewrite.net
DNS ASK pe####oclock.net
DNS ASK fo####nspeak.net
DNS ASK su###nwrite.net
DNS ASK fo####nwrite.net
DNS ASK su###nniece.net
DNS ASK fo####nniece.net
DNS ASK pi####eniece.net
DNS ASK ci####tteniece.net
DNS ASK pi####espeak.net
DNS ASK ci####ttespeak.net
DNS ASK pi####ewrite.net
DNS ASK ci####tteoclock.net
DNS ASK ch####enspeak.net
DNS ASK ci####ttewrite.net
DNS ASK pi####eoclock.net
DNS ASK th###hspeak.net
DNS ASK fi###eniece.net
DNS ASK ri###oclock.net
DNS ASK fi###espeak.net
DNS ASK th###hniece.net
DNS ASK fi####oclock.net
DNS ASK th####oclock.net
DNS ASK fi###ewrite.net
DNS ASK th###hwrite.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial