Trojan.Inject1.25418

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ofvi' = '%APPDATA%\Roaming\Myvia\ofvi.exe'

Malicious functions:

Creates and executes the following:

'%APPDATA%\Roaming\Myvia\ofvi.exe'

Executes the following:

'<SYSTEM32>\wermgr.exe' -queuereporting
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\taskhost.exe"

Injects code into

the following system processes:

<SYSTEM32>\wermgr.exe

Modifies file system :

Creates the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fujzzdbiaihlblxcskaycauc_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\njxamgirgkrwhyemprbqsotrgrw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hhelzpqkdyphmnypaixuktskfeu_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lnkzbtltrsytxkcyylpbcqpb_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgqgtsgfyhadetbxkrd_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uohtlzpkfmovcmgamnpzojeqt_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\chpbmtmfamfeluhykzuonizy_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hiribtpnderpnzlpzhaudehu_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kjetwxgnhqaybqcmnjovgaxdqo_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gmzfehizhceytbmxskeauoeagudmrw_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zaexkjnwpkbxgfyuhufkn_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amfmzbirwaqmfprghucpeapjov_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pvwtggmtoirusxovrkivxei_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwpmrlrdcdmhmrxwhqcqwovsnv_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zldgarsskpcadwglryhmbuob_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvgayukovtoqogaxszddlftkwgtw_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ojuofqeiygavgvdbqzpnrg_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qwytxjbxtofxsxvqeupfpylxc_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rkpuvhwcxnbmnnrzhhaijdov_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\usxglrytpflnpvppxolbaknwolh_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nvfobnjgyeapvpfbufdyssgdipv_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghayltsqwmrovcqjpzaqlvltzxz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mnxrcxkvxdqfyypthajnpzknl_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lfsoceayswvwsxprwydwomwo_info[1]
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat
<LS_APPDATA>\Microsoft\Windows Mail\edb.log
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol
%TEMP%\LRKED8A.bat
<LS_APPDATA>\Microsoft\Windows Mail\tmp.edb
%APPDATA%\Roaming\Myvia\ofvi.exe
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\edb00002.log
<LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore
<LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
<LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
%TEMP%\ppcrlui_3380_2
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jbkraefaceydpborvsekrqcwcbgmga_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zlgmdxeyzthtcgqlxcatobvw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wsowogmozmjpjbuqwfmnpvdakzrkn_biz[1]
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\35AB0E03-00000001.eml
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol
%TEMP%\Tar957C.tmp
%TEMP%\Cab957B.tmp
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\35AB0E03-00000001.eml:OECustomProperty

Deletes the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\usxglrytpflnpvppxolbaknwolh_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rkpuvhwcxnbmnnrzhhaijdov_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lfsoceayswvwsxprwydwomwo_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nvfobnjgyeapvpfbufdyssgdipv_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uohtlzpkfmovcmgamnpzojeqt_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgqgtsgfyhadetbxkrd_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lnkzbtltrsytxkcyylpbcqpb_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mnxrcxkvxdqfyypthajnpzknl_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qwytxjbxtofxsxvqeupfpylxc_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ojuofqeiygavgvdbqzpnrg_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvgayukovtoqogaxszddlftkwgtw_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pvwtggmtoirusxovrkivxei_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghayltsqwmrovcqjpzaqlvltzxz_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zldgarsskpcadwglryhmbuob_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwpmrlrdcdmhmrxwhqcqwovsnv_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zlgmdxeyzthtcgqlxcatobvw_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jbkraefaceydpborvsekrqcwcbgmga_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kjetwxgnhqaybqcmnjovgaxdqo_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wsowogmozmjpjbuqwfmnpvdakzrkn_biz[1]
%TEMP%\Cab957B.tmp
%TEMP%\Tar957C.tmp
%TEMP%\ppcrlui_3380_2
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hiribtpnderpnzlpzhaudehu_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hhelzpqkdyphmnypaixuktskfeu_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\njxamgirgkrwhyemprbqsotrgrw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fujzzdbiaihlblxcskaycauc_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gmzfehizhceytbmxskeauoeagudmrw_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\chpbmtmfamfeluhykzuonizy_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amfmzbirwaqmfprghucpeapjov_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zaexkjnwpkbxgfyuhufkn_com[1]

Moves the following files:

from <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log to <LS_APPDATA>\Microsoft\Windows Mail\edb.log

Deletes itself.

Network activity:

Connects to:

'us#######flnpvppxolbaknwolh.net':80
'rk#######nbmnnrzhhaijdov.org':80
'lf#######wvwsxprwydwomwo.info':80
'nv#######eapvpfbufdyssgdipv.biz':80
'uo#######movcmgamnpzojeqt.net':80
'qg#####fyhadetbxkrd.com':80
'ln######rsytxkcyylpbcqpb.ru':80
'mn#######dqfyypthajnpzknl.com':80
'qw#######ofxsxvqeupfpylxc.net':80
'oj######ygavgvdbqzpnrg.biz':80
'lv#######toqogaxszddlftkwgtw.ru':80
'pv######oirusxovrkivxei.org':80
'rg#######wmrovcqjpzaqlvltzxz.ru':80
'zl#######pcadwglryhmbuob.com':80
'uw#######dmhmrxwhqcqwovsnv.info':80
'zl#######thtcgqlxcatobvw.com':80
'jb########ydpborvsekrqcwcbgmga.ru':80
'kj#######qaybqcmnjovgaxdqo.com':80
'ws########jpjbuqwfmnpvdakzrkn.biz':80
'20#.#6.232.182':80
'74.##5.232.51':80
'www.bing.com':80
'hi#######erpnzlpzhaudehu.net':80
'hh#######yphmnypaixuktskfeu.com':80
'nj#######krwhyemprbqsotrgrw.biz':80
'fu#######ihlblxcskaycauc.org':80
'gm########eytbmxskeauoeagudmrw.ru':80
'ch#######mfeluhykzuonizy.biz':80
'am#######aqmfprghucpeapjov.info':80
'za######pkbxgfyuhufkn.com':80

TCP:

HTTP GET requests:

us#######flnpvppxolbaknwolh.net/
rk#######nbmnnrzhhaijdov.org/
lf#######wvwsxprwydwomwo.info/
nv#######eapvpfbufdyssgdipv.biz/
uo#######movcmgamnpzojeqt.net/
qg#####fyhadetbxkrd.com/
ln######rsytxkcyylpbcqpb.ru/
mn#######dqfyypthajnpzknl.com/
qw#######ofxsxvqeupfpylxc.net/
oj######ygavgvdbqzpnrg.biz/
lv#######toqogaxszddlftkwgtw.ru/
pv######oirusxovrkivxei.org/
rg#######wmrovcqjpzaqlvltzxz.ru/
zl#######pcadwglryhmbuob.com/
uw#######dmhmrxwhqcqwovsnv.info/
zl#######thtcgqlxcatobvw.com/
jb########ydpborvsekrqcwcbgmga.ru/
kj#######qaybqcmnjovgaxdqo.com/
ws########jpjbuqwfmnpvdakzrkn.biz/
20#.#6.232.182/pki/crl/products/CodeSignPCA.crl
74.##5.232.51/
www.bing.com/
hi#######erpnzlpzhaudehu.net/
hh#######yphmnypaixuktskfeu.com/
nj#######krwhyemprbqsotrgrw.biz/
fu#######ihlblxcskaycauc.org/
gm########eytbmxskeauoeagudmrw.ru/
ch#######mfeluhykzuonizy.biz/
am#######aqmfprghucpeapjov.info/
za######pkbxgfyuhufkn.com/

UDP:

DNS ASK uo#######movcmgamnpzojeqt.net
DNS ASK fu#######ihlblxcskaycauc.org
DNS ASK nj#######krwhyemprbqsotrgrw.biz
DNS ASK nv#######eapvpfbufdyssgdipv.biz
DNS ASK ln######rsytxkcyylpbcqpb.ru
DNS ASK qg#####fyhadetbxkrd.com
DNS ASK am#######aqmfprghucpeapjov.info
DNS ASK ch#######mfeluhykzuonizy.biz
DNS ASK dn#.##ftncsi.com
DNS ASK hh#######yphmnypaixuktskfeu.com
DNS ASK gm########eytbmxskeauoeagudmrw.ru
DNS ASK za######pkbxgfyuhufkn.com
DNS ASK us#######flnpvppxolbaknwolh.net
DNS ASK oj######ygavgvdbqzpnrg.biz
DNS ASK qw#######ofxsxvqeupfpylxc.net
DNS ASK pv######oirusxovrkivxei.org
DNS ASK us########paumbizuccqgiwsctkh.net
DNS ASK ei######vosoghknfapraxb.com
DNS ASK lv#######toqogaxszddlftkwgtw.ru
DNS ASK mn#######dqfyypthajnpzknl.com
DNS ASK lf#######wvwsxprwydwomwo.info
DNS ASK rk#######nbmnnrzhhaijdov.org
DNS ASK uw#######dmhmrxwhqcqwovsnv.info
DNS ASK zl#######pcadwglryhmbuob.com
DNS ASK rg#######wmrovcqjpzaqlvltzxz.ru
DNS ASK www.google.com
DNS ASK www.bing.com
DNS ASK crl.microsoft.com
DNS ASK hi#######erpnzlpzhaudehu.net
DNS ASK jb########ydpborvsekrqcwcbgmga.ru
DNS ASK kj#######qaybqcmnjovgaxdqo.com
DNS ASK ws########jpjbuqwfmnpvdakzrkn.biz
DNS ASK zl#######thtcgqlxcatobvw.com
'76.##6.114.217':1684
'21#.#4.146.36':1732
'10#.#4.172.39':3059
'2.###.133.66':6474
'20#.#09.58.176':24069
'18#.#42.108.42':4510
'64.##6.115.72':10010
'66.##.204.26':24382
'2.##.50.124':24606
'10#.#17.117.139':8593
'10#.#34.133.110':8387
'46.#9.36.20':9752
'84.#9.131.0':7605
'82.##1.180.182':5457
'17#.#3.147.65':3319
'12#.#38.67.140':4636
'90.##6.118.144':2081
'21#.#32.249.173':2848

Miscellaneous:

Searches for the following windows:

ClassName: 'OutlookExpressHiddenWindow' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial