Dropper.A_11481 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
- MutexPolesskayaGlush*.*\xc2\x90svchost.com\xc2\x90exefile\shell\open\command\xe2\x80\xb9\xc3\x80 "%1" %*\xc9\x93\xe2\x80\x98@
Directory level activity- create - dir - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\3582-490
File level activity- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\3582-490\62a332ebf1a51f99b1c5553ef30588b7
- write - file - C:\WINDOWS\svchost.com
- write - file - C:\DOCUME~1\TestMachine\MYDOCU~1\DOWNLO~1\PIL-11~1.EXE
- write - file - C:\DOCUME~1\TestMachine\MYDOCU~1\DOWNLO~1\PROCES~1\procexp.exe
- write - file - C:\DOCUME~1\TestMachine\MYDOCU~1\DOWNLO~1\wrar420.exe
- write - file - C:\KZFUNS~1\bin\execsc.exe
- write - file - C:\KZFUNS~1\PIN\ia32\pin.exe
- write - file - C:\KZFUNS~1\PIN\ia32\pindb.exe
- write - file - C:\KZFUNS~1\PIN\intel64\pin.exe
- write - file - C:\KZFUNS~1\PIN\intel64\pindb.exe
- write - file - C:\Python27\Lib\DISTUT~1\command\WININS~1.EXE
- write - file - C:\Python27\Lib\DISTUT~1\command\WININS~2.EXE
- write - file - C:\Python27\Lib\DISTUT~1\command\WININS~3.EXE
- write - file - C:\Python27\Lib\DISTUT~1\command\WININS~4.EXE
- write - file - C:\Python27\Lib\DISTUT~1\command\WIC4AA~1.EXE
- write - file - C:\Python27\Lib\SITE-P~1\pip\_vendor\distlib\t32.exe
- write - file - C:\Python27\Lib\SITE-P~1\pip\_vendor\distlib\t64.exe
- write - file - C:\Python27\Lib\SITE-P~1\pip\_vendor\distlib\w32.exe
- write - file - C:\Python27\Lib\SITE-P~1\pip\_vendor\distlib\w64.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\cli-32.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\cli-64.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\CLI-AR~1.EXE
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\cli.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\gui-32.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\gui-64.exe
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\GUI-AR~1.EXE
- write - file - C:\Python27\Lib\SITE-P~1\SETUPT~1\gui.exe
- write - file - C:\Python27\REMOVE~1.EXE
- write - file - C:\Python27\Scripts\EASY_I~2.EXE
- write - file - C:\Python27\Scripts\EASY_I~1.EXE
- write - file - C:\Python27\Scripts\pip.exe
- write - file - C:\Python27\Scripts\PIP27~1.EXE
- write - file - C:\Python27\Scripts\pip2.exe
- write - file - C:\Python27\w9xpopen.exe
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\tmp5023.tmp
Registry level activity- write - registry - HKEY_CLASSES_ROOT\exefile\shell\open\command
Library level activity
Process API calls used
- NtFreeVirtualMemory
- ShellExecuteExW
- NtCreateSection
- ZwMapViewOfSection
- ExitProcess
Registry API calls used
- RegOpenKeyExA
- RegSetValueExA
- RegCloseKey
- NtOpenKey
- NtQueryValueKey
System API calls used
Filesystem API calls used
- NtCreateFile
- NtReadFile
- FindFirstFileExW
- CreateDirectoryW
- NtQueryDirectoryFile
- NtQueryInformationFile
- NtSetInformationFile
- NtWriteFile
- NtOpenFile
- NtWriteFile
Network
UDP source >> destination
- 192.168.30.254 >> 192.168.30.8
- 192.168.30.8 >> 192.168.30.255
TCP source >> destination
- 192.168.30.8 >> 192.168.30.254
Domains:
DNS Request:
HTTP Request:
DLL related data
Number of DLL's imported = 10
- kernel32.dll
- user32.dll
- advapi32.dll
- oleaut32.dll
- kernel32.dll
- advapi32.dll
- kernel32.dll
- gdi32.dll
- user32.dll
- shell32.dll
|
