SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  MalAgent.J_90054
MalAgent.J_90054 is a Virus. Virus is a type of malware that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or the boot sector of the hard drive

Mutexes created
  • -


Directory level activity
  • create - dir - C:\Documents and Settings\TestMachine\Application Data\india gamcaa\


File level activity
  • write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\EDQHU.txt
  • delete - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\EDQHU.txt
  • write - file - PIPE\wkssvc
  • delete - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\EDQHU.bat
  • write - file - C:\Documents and Settings\TestMachine\Application Data\india gamcaa\indiagamcaa.exe
  • write - file - C:\Documents and Settings\TestMachine\Application Data\india gamcaa\indiagamcaa.exe


Registry level activity
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersPersonal
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0932c062-299c-11e2-afd8-806d6172696f}\BaseClass
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0932c060-299c-11e2-afd8-806d6172696f}\BaseClass
  • write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon Documents
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersDesktop
  • write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon Desktop
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCache
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCookies
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoamMUICacheC:\DOCUME~1\TestMachine\LOCALS~1\Temp\EDQHU.bat
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runindiagamcaaa
  • write - registry - HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gam
  • write - registry - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session ManagerStubPath


Library level activity
  • load - library - C:\WINDOWS\system32\rpcss.dll
  • load - library - C:\WINDOWS\system32\uxtheme.dll
  • load - library - uxtheme.dll
  • load - library - OLEAUT32.DLL
  • load - library - oleaut32.dll
  • load - library - ole32.dll
  • load - library - SXS.DLL
  • load - library - USER32
  • load - library - kernel32.dll
  • load - library - MSVBVM60.DLL
  • load - library - User32.dll
  • load - library - C:\WINDOWS\system32\kernel32.dll
  • load - library - C:\WINDOWS\system32\MSVBVM60.DLL
  • load - library - kernel32
  • load - library - CLBCATQ.DLL
  • load - library - KERNEL32.DLL
  • load - library - C:\WINDOWS\system32\wshom.ocx
  • load - library - C:\WINDOWS\system32\scrrun.dll
  • load - library - shell32.dll
  • load - library - netapi32
  • load - library - OLE32.DLL
  • load - library - C:\WINDOWS\system32\SHELL32.dll
  • load - library - SHELL32.dll
  • load - library - SETUPAPI.dll
  • load - library - C:\WINDOWS\system32\urlmon.dll
  • load - library - Secur32.dll
  • load - library - userenv
  • load - library - KERNEL32
  • load - library - VERSION.dll
  • load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\EDQHU.bat
  • load - library - browseui.dll
  • load - library - shlwapi
  • load - library - shell32
  • load - library - lz32.dll
  • load - library - ADVAPI32.dll
  • load - library - advapi32
  • load - library - mscoree.dll
  • load - library - advapi32.dll
  • load - library - ntdll.dll
  • load - library - Kernel32
  • load - library - ADVAPI32.DLL
  • load - library - CRYPT32.DLL
  • load - library - GDI32.dll
  • load - library - msvcrt.dll
  • load - library - SHELL32.DLL
  • load - library - USER32.dll
  • load - library - WS2_32.dll
  • load - library - user32.dll
  • load - library - uxtheme.dll


Process API calls used
  • ZwMapViewOfSection
  • VirtualProtectEx
  • WriteProcessMemory
  • WriteProcessMemory


Registry API calls used
  • NtOpenKey
  • NtQueryValueKey
  • RegOpenKeyExA
  • RegOpenKeyExA


System API calls used
  • LdrGetDllHandle
  • LdrLoadDll
  • IsDebuggerPresent
  • LdrGetProcedureAddress
  • SetWindowsHookExA
  • LdrGetProcedureAddress


Filesystem API calls used
    • Nothing to report

    Network

    UDP source >> destination
    • 192.168.30.254 >> 192.168.30.6
    • 192.168.30.6 >> 192.168.30.254
    • 192.168.30.6 >> 192.168.30.255
    • 192.168.30.6 >> 8.8.8.8


    TCP source >> destination
    • 192.168.30.6 >> 192.168.30.254



    Domains:
    • killerlgg.no-ip.biz with IP -

    DNS Request:
    • killerlgg.no-ip.biz

    HTTP Request:
    • NA

    DLL related data
    Number of DLL's imported = 1
    • MSVBVM60.DLL

    Relevant Information


    © SonicWall 2020 | Privacy Policy | Conditions for use Version: 10.0