Trojan.Win32.Swrort.3_3cbfcf601d

by malwarelabrobot on October 23rd, 2016 in Malware Descriptions.

Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 3cbfcf601db1fdfb495978d8b65a01bb
SHA1: 894987966f277feb3ee4ec221d1a1b7f668208e7
SHA256: 1dffdb8dfe4a72e5cb63d4388468e13a9b03b7a47dd9c678419cb314f1f74106
SSDeep: 196608:rtCvtHT5OrJ21nFH5azqhP92O8CtM1bZjDb:utHt2J2Npkz 9zm19j/
Size: 6418432 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-10-12 05:41:13
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:2460
regsvr32.exe:2640
regsvr32.exe:2456
regsvr32.exe:1256
regsvr32.exe:560
regsvr32.exe:3156
regsvr32.exe:3136
regsvr32.exe:3336
regsvr32.exe:3168
regsvr32.exe:2364
regsvr32.exe:3176
%original file name%.exe:2636

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process regsvr32.exe:2460 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:2640 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:560 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:3156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:3136 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:3336 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:3168 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process regsvr32.exe:3176 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (823 bytes)

The process %original file name%.exe:2636 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Data\dm.dll (8230 bytes)

Registry activity

The process regsvr32.exe:2460 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\dm.dmsoft\CLSID]
"(Default)" = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}]
"(Default)" = "dm.dmsoft"

[HKCR\dm.dmsoft]
"(Default)" = "dm.dmsoft"

[HKCR\dm.dmsoft\CurVer]
"(Default)" = "dm.dmsoft"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32]
"(Default)" = "c:\Data\dm.dll"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID]
"(Default)" = "dm.dmsoft"

The Trojan deletes the following registry key(s):