MalAgent.J_73092 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
Directory level activity
File level activity- write - file - PIPE\lsarpc
- write - file - PIPE\lsarpc
Registry level activity
Library level activity- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\0e46dbfab22c5844c4a72412ab09b42c.bin.dll
- load - library - C:\WINDOWS\system32\uxtheme.dll
- load - library - uxtheme.dll
- load - library - NTDLL.DLL
- load - library - ntdll.dll
- load - library - KERNEL32.dll
- load - library - OLEAUT32.dll
- load - library - WINHTTP.dll
- load - library - KERNEL32.DLL
- load - library - ole32.dll
- load - library - C:\WINDOWS\system32\rpcss.dll
- load - library - USER32.dll
- load - library - ADVAPI32.dll
- load - library - Secur32.dll
- load - library - SHLWAPI.dll
- load - library - CLBCATQ.DLL
- load - library - C:\WINDOWS\system32\wbem\wbemprox.dll
- load - library - wmisvc.dll
- load - library - C:\WINDOWS\system32\winlogon.exe
- load - library - xpsp2res.dll
- load - library - OLE32
- load - library - OLE32.DLL
- load - library - C:\WINDOWS\system32\wbem\wbemsvc.dll
- load - library - C:\WINDOWS\system32\wbem\fastprox.dll
- load - library - oleaut32.dll
- load - library - C:\WINDOWS\system32\rpcrt4.dll
- load - library - SXS.DLL
- load - library - OLEAUT32
- load - library - ADVAPI32.DLL
- load - library - ws2_32
- load - library - ws2_32
Process API calls used
- NtCreateSection
- ZwMapViewOfSection
- VirtualProtectEx
- NtOpenSection
- NtFreeVirtualMemory
- NtOpenSection
Registry API calls used
- NtOpenKey
- NtQueryValueKey
- RegOpenKeyExW
- RegQueryValueExW
- RegCloseKey
- RegCreateKeyExW
- RegOpenKeyExA
- RegQueryValueExA
- RegEnumKeyExA
- RegOpenKeyExA
System API calls used
- LdrLoadDll
- IsDebuggerPresent
- LdrGetDllHandle
- LdrGetProcedureAddress
- NtDelayExecution
- NtDelayExecution
Filesystem API calls used
- NtOpenFile
- FindFirstFileExW
- NtCreateFile
- NtQueryInformationFile
- NtQueryDirectoryFile
- NtSetInformationFile
- NtReadFile
- NtWriteFile
- NtQueryInformationFile
Network
UDP source >> destination - 192.168.30.254 >> 192.168.30.8
- 192.168.30.8 >> 192.168.30.254
- 192.168.30.8 >> 192.168.30.255
- 192.168.30.8 >> 8.8.8.8
TCP source >> destination - 192.168.30.8 >> 192.168.30.254
Domains:- zvednyisvet.ru with IP -
- tramvaineedet.ru with IP -
DNS Request:- zvednyisvet.ru
- tramvaineedet.ru
HTTP Request: DLL related data Number of DLL's imported = 9
- KERNEL32.dll
- USER32.dll
- GDI32.dll
- COMDLG32.dll
- ADVAPI32.dll
- SHELL32.dll
- ole32.dll
- SHLWAPI.dll
- COMCTL32.dll
|