MD5: 453f39ae5ea386ce7c024249ae393804
SHA1: c4199f9ef2363bbd28f4dbd86b6e9a279743484b
SHA256: 472f9c7ff8691254a6fd18eb110bea62ba85897e9cb143b3acdde87c9f5bed81
SSDeep: 196608:epg81OENlDjllJbaPEvH/El5F3ISEsPYXYmZ79Svholf:e3UEN1llnvfiDyjSvhwf
Size: 8040194 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: CinemXidv1.3V23.09
Created at: 2009-12-04 15:35:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1068

The Trojan injects its code into the following process(es):

360.exe:1076
lmy.exe:1312

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process 360.exe:1076 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\2011.exe (1281 bytes)
%WinDir%\V2011.exe (1281 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR (1281 bytes)

The process %original file name%.exe:1068 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lmy.exe (53851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\360.exe (203 bytes)

The process lmy.exe:1312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm2.tmp (608329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\FindProcDLL.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ÁúÂíÓÎ.zip (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE_NSIS.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\left.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE.dll (9608 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1.tmp (0 bytes)

Registry activity

The process 360.exe:1076 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 2B C2 2F 96 0B E3 38 64 A5 C2 37 0E FB 36 5D"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%WinDir%\temp\2011.exe, \??\%Documents and Settings%\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\SVCHOST.SCR"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"V2011" = "%WinDir%\V2011.exe"

The process %original file name%.exe:1068 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 24 37 53 99 0C CC 77 19 5C 3D F8 E5 DE 84 8C"

The process lmy.exe:1312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 45 BC E7 54 94 8A 06 F8 C9 CC 68 79 B5 61 AB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

.rdata

@.data

.rsrc

|$<.tK

D$XRPSSh

USER32.dll

GDI32.dll

ADVAPI32.dll

SHELL32.dll

SHLWAPI.dll

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

WINMM.dll

__MSVCRT_HEAP_SELECT

user32.dll

WS2_32.dll

WININET.dll

MSVFW32.dll

PSAPI.DLL

WTSAPI32.dll

GetAsyncKeyState

GetKeyState

ExitWindowsEx

EnumWindows

keybd_event

MapVirtualKeyA

EnumChildWindows

SetProcessWindowStation

OpenWindowStationA

GetProcessWindowStation

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

RegOpenKeyA

RegCreateKeyExA

RegSetKeySecurity

RegEnumKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

RegRestoreKeyA

RegSaveKeyA

ShellExecuteA

SHDeleteKeyA

InternetOpenUrlA

GetWindowsDirectoryA

WinExec

CreatePipe

DisconnectNamedPipe

KERNEL32.dll

ole32.dll

OLEAUT32.dll

NETAPI32.dll

MSVCRT.dll

AVICAP32.dll

GetCPInfo

%s//%s

Microsoft\Network\Connections\pbk\rasphone.pbk

\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk

RasDialParams!%s#0

%s\%s

%s\shell\open\command

%s\*.*

%s%s%s

%s%s*.*

a %s %s

a -r %s %s

rar.exe

x %s %s

SYSTEM\CurrentControlSet\Services\%s

Http/1.1 403 Forbidden

:] %s

:]%d-%d-%d %d:%d:%d

s !socketClient.Connect !=-1

Applications\iexplore.exe\shell\open\command

ddd.exe

Windows Windows7/Vista/2008

Windows 2003

Windows XP

Windows 2000

Windows NT

QQPCTray.exe

KSafeTray.exe

kxetray.exe

egui.exe

exe.DnoMvaR

KvMonXP.exe

avp.exe

exe.ds063

360tray.exe

PortNumber

SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp

:%dMB

:%dGB

.DEFAULT\Keyboard Layout\Toggle

Hotkey

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Policies\Microsoft\Windows\Installer

SOFTWARE\Microsoft\Windows\CurrentVersion\netcache

C:\3389.bat

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d

c:\3389.bat

gdt = x

idt = x

%System%\ctfmon1.exe

%Documents and Settings%\All Users\

\SVCHOST.SCR

%WinDir%\V2011.exe

kernel32.dll

hXXp://

ws2_32.dll

@del 3596799a1543bc9f.aqq

afc9fe2f418b00a0.bat

%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR

%WinDir%\temp\svchost.exe

%WinDir%\temp\2011.exe

%-25s %-15s 0x%x(%d)

%-25s %-15s %s

\cmd.exe

PeekNamedPipe

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

Mozilla/4.0 (compatible)

hXXps://

ddd

passworD

OLEACC.DLL

Windows

%WinDir%\V2012.EXE

%WinDir%\V2012.exe

%WinDir%\V2013.exe

taskkill /f /im KSafeTray.exe

Rstray.exe

%s\SysTEM32\sysedit.exe

Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

explorer.exe

1.1.4

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe

[2014821135355]

2014821135355

3, 1, 3, 1000

Maxthon3.exe

360.exe_1076_rwx_00401000_00025000:

|$<.tK

D$XRPSSh

360.exe_1076_rwx_0042B000_00004000:

%s//%s

Microsoft\Network\Connections\pbk\rasphone.pbk

\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk

RasDialParams!%s#0

%s\%s

%s\shell\open\command

%s\*.*

%s%s%s

%s%s*.*

a %s %s

a -r %s %s

rar.exe

x %s %s

SYSTEM\CurrentControlSet\Services\%s

Http/1.1 403 Forbidden

:] %s

:]%d-%d-%d %d:%d:%d

s !socketClient.Connect !=-1

Applications\iexplore.exe\shell\open\command

ddd.exe

Windows Windows7/Vista/2008

Windows 2003

Windows XP

Windows 2000

Windows NT

QQPCTray.exe

KSafeTray.exe

kxetray.exe

egui.exe

exe.DnoMvaR

KvMonXP.exe

avp.exe

exe.ds063

360tray.exe

PortNumber

SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp

:%dMB

:%dGB

.DEFAULT\Keyboard Layout\Toggle

Hotkey

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Policies\Microsoft\Windows\Installer

SOFTWARE\Microsoft\Windows\CurrentVersion\netcache

C:\3389.bat

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d

c:\3389.bat

gdt = x

idt = x

%System%\ctfmon1.exe

%Documents and Settings%\All Users\

\SVCHOST.SCR

%WinDir%\V2011.exe

kernel32.dll

hXXp://

ws2_32.dll

KERNEL32.dll

@del 3596799a1543bc9f.aqq

afc9fe2f418b00a0.bat

%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR

%WinDir%\temp\svchost.exe

%WinDir%\temp\2011.exe

%-25s %-15s 0x%x(%d)

%-25s %-15s %s

\cmd.exe

PeekNamedPipe

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

Mozilla/4.0 (compatible)

hXXps://

ddd

passworD

OLEACC.DLL

Windows

%WinDir%\V2012.EXE

%WinDir%\V2012.exe

%WinDir%\V2013.exe

taskkill /f /im KSafeTray.exe

Rstray.exe

%s\SysTEM32\sysedit.exe

Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

explorer.exe

1.1.4

360.exe_1076_rwx_00430000_00007000:

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe

lmy.exe_1312:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp

Eu%C@

t3x<%c

__MSVCRT

2.dll}

G.Hook

KERNEL32.DLL

SkinSE.dll

SkinSE_NSIS.dll

@.reloc

GetProcessHeap

comdlg32.dll

nsDialogs.dll

All Files|*.*

URL=hXXp://VVV.999qp.com/

.reloc

System.dll

callback%d

/%x5>

<.LXb

.HjOk

nsr3.tmp

1311000

adm\LOCALS~1\Temp\nsr3.tmp

1245478

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe

%Program Files%\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

lmy.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

1245448

-888535893

1376588

1114340

1573138

1311006

1442010

1179898

1245452

1310942

-1308294008

1179886

1966300

1048670

1179860

D:\temp

11131827

J.nzm

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.45</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

lmy.exe_1312_rwx_003C1000_0000D000:

__MSVCRT_HEAP_SELECT

user32.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe

GetCPInfo

.text

`.rdata

@.data

.reloc

__MSVCRT

2.dll}

G.Hook

lmy.exe_1312_rwx_029B1000_000DC000:

<.uTV

USSSSSSh

t%UVWS

SSh0j

9^ u%f

~%UVW

uù u f9k

inflate 1.1.3 Copyright 1995-1998 Mark Adler

?CxImage 6.0.0

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

1.2.3

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%s%d bytes

Element '%s' at offset %d not ended

End tag '%s' at offset %d does not match start tag '%s' at offset %d

No start tag for end tag '%s' at offset %d

%s at offset %d unterminated

Incorrect %s at offset %d

msctls_hotkey32

%*.*f

\winhlp32.exe

%.f%%

hotkey

1.1.3

%s%s%s

1.2.24

compression type not supported

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

iTXt chunk not supported.

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

Invalid component ID %d in SOS

Bogus message code %d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

NULL row buffer for row %ld, pass %d

%ld%c

GetWindowsDirectoryA

GetViewportExtEx

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumChildWindows

EnumThreadWindows

)(56")0%

8000000000000000000

9.KAbC

.text

`.rdata

@.data

.reloc

!7.LkWh=IP0v

lmy.exe_1312_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1068
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %WinDir%\Temp\2011.exe (1281 bytes)
   %WinDir%\V2011.exe (1281 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lmy.exe (53851 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\360.exe (203 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm2.tmp (608329 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\FindProcDLL.dll (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ÁúÂíÓÎ.zip (8560 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE_NSIS.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\left.bmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE.dll (9608 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "V2011" = "%WinDir%\V2011.exe"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.