MD5: d7e154972b5da73013da6a16ba6adada
SHA1: 2e270d762b6ddec1fbb07cf683b63f6deb412f1c
SHA256: 00357d00e7e5418496a35d573665b0b2257e91d0371358a876fb65d7a9a37bb9
SSDeep: 1536:m3rJJyVemDdYBK7xmrhhXzNozBTCXv3GgX:CWDdYBKWNBowN
Size: 60928 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

Process activity

The MemScan creates the following process(es):

%original file name%.exe:1856
dwwin.exe:456

The MemScan injects its code into the following process(es):

biiqrzr.cmd:560

File activity

The process biiqrzr.cmd:560 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%System%\WindowsUpdt.exe (19 bytes)

The process %original file name%.exe:1856 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%WinDir%\xwrm.exe (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iirqar.arqj.jay (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\728a_appcompat.txt (6214 bytes)

The process dwwin.exe:456 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EBEDUZMH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PFLAY7K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3UX696B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\77D5B.dmp (78539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I94FGPK1\desktop.ini (67 bytes)

Registry activity

The process biiqrzr.cmd:560 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 27 4F 3C DE 95 88 A6 5B 60 3A 52 92 36 A5 5E"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WihdowsUpdate" = "%System%\WindowsUpdt.exe"

The process %original file name%.exe:1856 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 EB C6 D1 5B 82 C0 19 14 B8 4A B7 ED FE 3C E0"

To automatically run itself each time Windows is booted, the MemScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

The MemScan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The MemScan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process dwwin.exe:456 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 63 84 9F E3 E6 5D F2 81 8A 7A 18 AD 10 E7 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The MemScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET CNC Shadowserver Reported CnC Server IP group 14
ET CHAT IRC NICK command
ET CHAT IRC PING command
ET CHAT IRC PONG response
ET CHAT IRC USER command

Traffic

Web Traffic was not found.

\xwrm.exe

%WinDir%\xwrm.exe

Software\Microsoft\Windows\CurrentVersion\Run

USER %s 8 * :%s

NICK %s

PONG %s

JOIN #england

PRIVMSG #england :.-:[X-Worm]:-.

irc.undernet.org

MAIL FROM:<%s>

RCPT TO:<%s>

--%s--

From:<%s>

To: %s

Subject:%s

boundary="%s"

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

charset="windows-1255"

name= "%s%s"

Content-Disposition: attachment; filename="%s%s"

Support

No.reply

8.txtt:

8.htmt2

8.rtft*

8.doct"

8.bdxt

8.phpt

8.jspt

8.cgit

smtp

ws2_32.dll

ADVAPI32.DLL

RegOpenKeyExA

RegCloseKey

User32.dll

fs_snap.exe

arnsec.exe

ISABL~1.EXE

8.exe

8.scrtt

8.avitJ

8.doctB

8.mp3t:

8.mpgt2

8.xlst*

8.jpgt"

8.zipt

8.isot

8.pdft

8.pptt

8.rart

D:\fs_snap.exe

SFC.DLL

Pajzaiy.yrar

D:\ajzaiy.yrar

ReadMe.exe

c:\%original file name%.exe

131c346.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\iirqar.arqj.jay

WinExec

GetWindowsDirectoryA

FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALERj

biiqrzr.cmd

.text

.rsrc

gu>%uM

~nt.ex

CrToMaPh

hPRIVMSG %s :

kernel32.dll

.%suld nb

KERNEL32.dll

2'3.3`3}3

0M1e1w1}1-2x2

biiqrzr.cmd_560:

.text

.rsrc

\WindowsUpdt.exe

irc.undernet.org

__MSVCRT_HEAP_SELECT

user32.dll

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

WS2_32.dll

InternetOpenUrlA

WININET.dll

GetCPInfo

url1.dat

PRIVMSG %s :Operations Stoped

PRIVMSG %s :Wasting %s

PRIVMSG %s :Udp Floding %s

-!udp_flood

PRIVMSG %s :%s Downloaded&executed

1.exe

-!download_exe

PRIVMSG %s :Login Success

-!login

PRIVMSG

%*s %s %*s %s %s %s

MODE %s  nsk %s

JOIN %s %s

PONG %s

NICK %s

USER %s 8 * :%s

Software\Microsoft\Windows\CurrentVersion\Run

2614211705

D:\biiqrzr.cmd

kernel32.dll

.%suld nb

biiqrzr.cmd_560_rwx_00401000_0000F000:

\WindowsUpdt.exe

irc.undernet.org

__MSVCRT_HEAP_SELECT

user32.dll

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

WS2_32.dll

InternetOpenUrlA

WININET.dll

GetCPInfo

url1.dat

PRIVMSG %s :Operations Stoped

PRIVMSG %s :Wasting %s

PRIVMSG %s :Udp Floding %s

-!udp_flood

PRIVMSG %s :%s Downloaded&executed

1.exe

-!download_exe

PRIVMSG %s :Login Success

-!login

PRIVMSG

%*s %s %*s %s %s %s

MODE %s  nsk %s

JOIN %s %s

PONG %s

NICK %s

USER %s 8 * :%s

Software\Microsoft\Windows\CurrentVersion\Run

2614211705

D:\biiqrzr.cmd

kernel32.dll

.%suld nb

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1856
   dwwin.exe:456

2. Delete the original MemScan file.
   
3. Delete or disinfect the following files created/modified by the MemScan:
   

   %System%\WindowsUpdt.exe (19 bytes)
   %WinDir%\xwrm.exe (60 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\iirqar.arqj.jay (60 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\728a_appcompat.txt (6214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EBEDUZMH\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3PFLAY7K\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3UX696B\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\77D5B.dmp (78539 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I94FGPK1\desktop.ini (67 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "WihdowsUpdate" = "%System%\WindowsUpdt.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "x32x" = "%WinDir%\xwrm.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.