Generic.Malware.SBdldprng.C021D3F7_80cb6d8cb6

by malwarelabrobot on April 14th, 2018 in Malware Descriptions.

Generic.Malware.SBdldprng.C021D3F7 (BitDefender), TrojanDropper:Win32/Dowque.A (Microsoft), Trojan-Dropper.Win32.Agent.athb (Kaspersky), Trojan.Win32.Dowque.ls (v) (VIPRE), BackDoor.Graybird.75 (DrWeb), Generic.Malware.SBdldprng.C021D3F7 (B) (Emsisoft), BackDoor-AWQ.b.gen.w (McAfee), Trojan.Gen.2 (Symantec), Backdoor.Win32.HacDef (Ikarus), Win32:Evo-gen [Susp] (AVG), Win32:Evo-gen [Susp] (Avast), TROJ_DOWQUE.NY (TrendMicro), Generic.Malware.SBdldprng.C021D3F7 (AdAware), Trojan.Win32.Ceatrg.FD, GenericInjector.YR, TrojanDropperPolymorph1.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan, Backdoor, Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 80cb6d8cb63133017abaaf649cc41dbf
SHA1: 4e538a75f67f2456eb5b88c307716e48f5233eae
SHA256: 111455360eb2abdd6df5294840ced3f718201895a6bc782b0c2789f5cdaca02d
SSDeep: 6144:8ZOiUbn8Wyd9mxoWIxgpUR070XAcDh2y9v m6S:7b8Fd9ax8o70X1Drz
Size: 449133 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

MIck.exe:1880
888.exe:2896
FUCK.exe:2856
6543.exe:3820
netsh.exe:1628
netsh.exe:2472
netsh.exe:1780
netsh.exe:3800
netsh.exe:3732
netsh.exe:1836
netsh.exe:2340
netsh.exe:3692
netsh.exe:952
netsh.exe:3436
netsh.exe:1716
netsh.exe:2016
netsh.exe:2240
netsh.exe:2876
netsh.exe:2180
netsh.exe:1592
netsh.exe:2836
netsh.exe:3228
netsh.exe:4052
netsh.exe:3784
netsh.exe:2992
netsh.exe:3680
netsh.exe:1972
netsh.exe:1688
DrvInst.exe:892
8881.exe:3320
%original file name%.exe:2668

The Generic injects its code into the following process(es):

WerFault.exe:1464
calc.exe:2128

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process MIck.exe:1880 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\TraceLog.txt (462 bytes)

The process 888.exe:2896 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\828000.dll (108 bytes)
C:\NT_Path.jpg (67 bytes)
C:\ProgramData\Aebblnroq.psd (3912007 bytes)
C:\Net-Temp.ini (3824 bytes)

The Generic deletes the following file(s):

C:\ProgramData\Aebblnroq.psd (0 bytes)
C:\Net-Temp.ini (0 bytes)

The process FUCK.exe:2856 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Windows\Temp\FUCK.bat (14 bytes)

The Generic deletes the following file(s):

C:\Windows\Temp\__tmp_rar_sfx_access_check_5069236 (0 bytes)

The process 6543.exe:3820 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\svchost.exe (72 bytes)

The process DrvInst.exe:892 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Windows\inf\setupapi.dev.log (414 bytes)

The process 8881.exe:3320 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5069190.dll (55 bytes)
C:\5069767.vbs (500 bytes)

The process %original file name%.exe:2668 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DeL!.bAt (132 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6543.exe (72 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\888.exe (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MIck.exe (180 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FUCK.exe (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8881.exe (98 bytes)

Registry activity

The process WerFault.exe:1464 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "1D 00 00 C0 00 00 00 00 00 00 00 00 20 FE 12 00"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

The process MIck.exe:1880 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M.s_2.0" = "%Program Files%\svchost.exe"

The process 888.exe:2896 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip]
"DLLPath" = "C:\828000.dll"

[HKLM\SOFTWARE\329730036\Parameters]
"ServiceDll" = "C:\ProgramData\Aebblnroq.psd"

[HKLM\SOFTWARE\163676141]
"imgsvc" = "StiSvc, Tomcat9"

The process calc.exe:2128 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"