MD5: c92b2adecc48de5f32b84ce8e83b1a8f
SHA1: 287e33399bbd40384a1310de63ffc0258a4937c7
SHA256: 43164d174eab3d39c64f4060fc594af794e499a16056d9ff17da080019474bfd
SSDeep: 1536:X 6KdAJM lsD6a5B9zIBdvbC2k3bMtlB0S2L5yD16r7xwn8 4:rbhsL0dvbCDAtlO2R6r7G
Size: 163840 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2008-12-26 23:14:15
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

taskkill.exe:576
taskkill.exe:624
%original file name%.exe:272
rundll32.exe:1364
sc.exe:1856
cacls.exe:148

The Trojan injects its code into the following process(es):

rundll32.exe:1056

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:272 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\update.dll (27526071 bytes)

The process rundll32.exe:1056 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\autorun.inf (21 bytes)
%System%\drivers\etc\hosts (5 bytes)
C:\$Directory (1748 bytes)
%System%\dllcache (4 bytes)
%System% (2816 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (96 bytes)
%System%\drivers (576 bytes)
%Documents and Settings%\%current user% (4 bytes)
%WinDir%\Prefetch\RUNDLL32.EXE-3DFF5969.pf (28 bytes)
C:\1.exe (673 bytes)
%WinDir%\Temp\Perflib_Perfdata_65c.dat (4 bytes)

Registry activity

The process taskkill.exe:576 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D D5 E2 F7 11 04 24 79 D3 A4 73 9A 39 C1 99 EB"

The process taskkill.exe:624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 9D DD 10 BF 4F A1 84 07 D6 45 A2 82 2B 55 E3"

The process rundll32.exe:1364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 46 7A FE 6F D6 1F B5 CA EC AA 7E 04 38 96 F9"

The process sc.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 25 DD 86 FC F5 4A 6C FA 5C A9 A5 F9 15 81 F3"

The process cacls.exe:148 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 92 64 F8 32 FF 52 51 F7 CC E9 A5 2F 33 1F 9A"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Trojan substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

rundll32.exe_1056_rwx_10000000_00001000:

.data

.rsrc

@.reloc

\\%s\IPC$

\pipe\browser

Bd

del "%s"

if exist "%s" goto Repeat

rmdir %s

192yuioealdjfiefjsdfas.txt

System32\DRIVERS\pcidump.sys

\drivers\pcidump.sys

%SystemRoot%\system32\drivers\puid.sys

\drivers\gm.dls

\\.\pcidump

tmp2.exe

@rename tmp2 tmp2.exe

@debug<tmp.tmp>nul

@echo q>>tmp.tmp

@echo w>>tmp.tmp

@echo n tmp2>>tmp.tmp

@echo %X>>tmp.tmp

@echo rcx>>tmp.tmp

>>tmp.tmp

%s%d.txt

Windows

Open=1.exe

autorun.inf

1.exe

urlmon

iexplore.exe

\explorer.exe

ALG.EXE

\ALG.EXE

\temp\explorer.exe

explorer.exe

_uninsep.bat

rundll32.exe_1056_rwx_10007000_00001000:

\??\c:\%original file name%.exe

\??\%WinDir%\explorer.exe

ers\gm.dls

WinExec

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

WS2_32.dll

MPR.dll

RPCRT4.dll

MSVCRT.dll

iexplore.exe_524:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   taskkill.exe:576
   taskkill.exe:624
   %original file name%.exe:272
   rundll32.exe:1364
   sc.exe:1856
   cacls.exe:148

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %System%\update.dll (27526071 bytes)
   C:\autorun.inf (21 bytes)
   %System%\drivers\etc\hosts (5 bytes)
   C:\$Directory (1748 bytes)
   %System%\dllcache (4 bytes)
   %System%\drivers\pcidump.sys (5404535 bytes)
   %System%\config (96 bytes)
   %Documents and Settings%\%current user% (4 bytes)
   %WinDir%\Prefetch\RUNDLL32.EXE-3DFF5969.pf (28 bytes)
   C:\1.exe (673 bytes)
   %WinDir%\Temp\Perflib_Perfdata_65c.dat (4 bytes)
   

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.