Trojan.Siggen9.51247

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%TEMP%\4dd3.tmp
%LOCALAPPDATA%low\a1xvpfvjc
%LOCALAPPDATA%low\jn3by345by53432y\firefox_gn7ryp3k.default.txt
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32_inuse.dll
%LOCALAPPDATA%low\rgrywtiiz
%APPDATA%\bfwbwui
%TEMP%\nsa437f.tmp\system.dll
%TEMP%\nsx4842.tmp\system.dll
%TEMP%\nsx4842.tmp\vakzf.dll
%TEMP%\jjun.com
%TEMP%\lol.com
%TEMP%\txbp.com
%TEMP%\473d.tmp.exe
%TEMP%\nsa437f.tmp\tod.dll
%TEMP%\fzjei.com
%TEMP%\wep.com
%TEMP%\abxiuk.com
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\a1xvpfvjc-shm
nul
%TEMP%\nsz1aaa.tmp\system.dll
%TEMP%\start.vbs
%TEMP%\filechanges.log.ps1
%TEMP%\nsz1aaa.tmp\nsunzip.dll
%TEMP%\hsuena4.tmp
%TEMP%\nsz1aaa.tmp\blowfish.dll
%TEMP%\1976.tmp.exe
%TEMP%\c94.tmp.exe
%LOCALAPPDATA%low\log.zip
%LOCALAPPDATA%low\s2trqf69a-shm
%LOCALAPPDATA%low\s2trqf69a
%TEMP%\ixp000.tmp\tmp1.exe
%LOCALAPPDATA%low\rgrywtiiz-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\3098htrhpen8ifg0\prldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssdbm3.dll
%TEMP%\9ad.tmp
%TEMP%\db03.tmp.exe
%LOCALAPPDATA%low\3098htrhpen8ifg0\hv8745939v498h.zip
%LOCALAPPDATA%low\machineinfo.txt
%TEMP%\be52.tmp.exe
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%TEMP%\6d3e.tmp-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\softokn3.dll
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\af7d.tmp.exe
%TEMP%\9760.tmp.exe
%APPDATA%\uuftvcv
%APPDATA%\uewbwui
%LOCALAPPDATA%low\bbsqwy6yhk
%TEMP%\ixp000.tmp\tmp2.exe
%LOCALAPPDATA%low\3098htrhpen8ifg0\ucrtbase.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblemarshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\vcruntime140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssckbi.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblehandler.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nss3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\qipcap.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozglue.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\libegl.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\lgpllibs.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldif60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ia2marshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\freebl3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\breakpadinjector.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\msvcp140.dll
%TEMP%\7182.tmp-shm

Sets the 'hidden' attribute to the following files

%APPDATA%\uewbwui
%APPDATA%\uuftvcv
%APPDATA%\bfwbwui

Deletes the following files

%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\3098htrhpen8ifg0\msvcp140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozglue.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\libegl.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\lgpllibs.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldif60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\freebl3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\breakpadinjector.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ia2marshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nss3.dll
%TEMP%\nsz1aaa.tmp\system.dll
%TEMP%\7182.tmp-shm
%TEMP%\6d3e.tmp-shm
%TEMP%\db03.tmp.exe
%TEMP%\9760.tmp.exe
%TEMP%\nsa437f.tmp\tod.dll
%TEMP%\nsa437f.tmp\system.dll
%TEMP%\nsx4842.tmp\vakzf.dll
%TEMP%\nsx4842.tmp\system.dll
%TEMP%\ixp000.tmp\tmp1.exe
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssdbm3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssckbi.dll
%TEMP%\nsz1aaa.tmp\nsunzip.dll
%TEMP%\nsz1aaa.tmp\blowfish.dll
%LOCALAPPDATA%low\log.zip
%LOCALAPPDATA%low\sqlite3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\vcruntime140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ucrtbase.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\softokn3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\qipcap.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\prldap60.dll
%TEMP%\ixp000.tmp\tmp2.exe
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\s2trqf69a
%LOCALAPPDATA%low\s2trqf69a-shm
%LOCALAPPDATA%low\rgrywtiiz
%LOCALAPPDATA%low\rgrywtiiz-shm
%LOCALAPPDATA%low\a1xvpfvjc
%LOCALAPPDATA%low\a1xvpfvjc-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblehandler.dll
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\3098htrhpen8ifg0\hv8745939v498h.zip
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblemarshal.dll
%LOCALAPPDATA%low\jn3by345by53432y\firefox_gn7ryp3k.default.txt
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\abxiuk.com
%TEMP%\txbp.com

Deletes itself.

Network activity

TCP

HTTP GET requests

http://10##########older33417-01242510022020.space/reestr.exe
http://34.##5.129.68/gate/libs.zip
http://34.##5.129.68/gate/sqlite3.dll
http://10##########older33417-01242510022020.space/raccon.exe

HTTP POST requests

http://10##########older33417-01242510022020.space/
http://34.##5.129.68/gate/log.php

'te##te.in':443

UDP

DNS ASK 10###########lder1002002131-service1002.space
DNS ASK 10###########lder1002002231-service1002.space
DNS ASK 10##########older3100231-service1002.space
DNS ASK 10###########lder1002002431-service1002.space
DNS ASK 10###########lder1002002531-service1002.space
DNS ASK 10##########older33417-01242510022020.space
DNS ASK te##te.in

Miscellaneous

Creates and executes the following

'%TEMP%\9760.tmp.exe'
'%TEMP%\af7d.tmp.exe'
'%TEMP%\be52.tmp.exe'
'%TEMP%\db03.tmp.exe'
'%TEMP%\c94.tmp.exe'
'%TEMP%\1976.tmp.exe'
'%TEMP%\ixp000.tmp\tmp1.exe'
'%TEMP%\ixp000.tmp\tmp2.exe'
'%TEMP%\473d.tmp.exe'
'<SYSTEM32>\cmd.exe' /c wmic process call create "wscript %temp%\start.vbs"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start tmp1.exe & start tmp2.exe' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C timeout /T 10 /NOBREAK > Nul & Del /f /q "%TEMP%\9760.tmp.exe"
'%WINDIR%\syswow64\timeout.exe' /T 10 /NOBREAK
'<SYSTEM32>\cmd.exe' /c wmic process call create "wscript %temp%\start.vbs"
'%WINDIR%\syswow64\cmd.exe' /c start tmp1.exe & start tmp2.exe
'<SYSTEM32>\wbem\wmic.exe' process call create "wscript %TEMP%\start.vbs"
'%WINDIR%\syswow64\cmd.exe' /c if not exist C:\\aaa_TouchMeNot.txt if NOT %computername% == NfZtFbPfH if NOT %computername% == ELICZ if NOT %computername% == tz if NOT %computername% == MAIN ping ZKAeUbIe.ZKAeUbIe -n 1 ||...
'%WINDIR%\syswow64\cmd.exe' /c if not exist C:\\aaa_TouchMeNot.txt if NOT %computername% == NfZtFbPfH if NOT %computername% == ELICZ if NOT %computername% == tz if NOT %computername% == MAIN ping WCSccHmvc.WCSccHmvc -n 1 ...
'%WINDIR%\syswow64\ping.exe' WCSccHmvc.WCSccHmvc -n 1
'%WINDIR%\syswow64\ping.exe' ZKAeUbIe.ZKAeUbIe -n 1
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\certutil.exe' -decode weP.com t
'%WINDIR%\syswow64\certutil.exe' -decode LoL.com G

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial