Trojan.DownLoader9.42191

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERd920.dir00\svchost.exe.mdmp 16325836412033116

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERd920.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Deletes itself.

Network activity:

Connects to:

'68.##5.129.148':139
'68.##5.106.219':445
'68.##5.196.51':139
'68.##5.182.71':139
'68.##5.77.189':139
'68.##5.211.196':445
'68.##5.250.156':445
'68.##5.145.216':445
'68.##5.24.212':445
'68.#55.8.35':445
'68.##5.246.128':139
'68.##5.234.180':139
'68.##5.70.127':139
'68.##5.159.205':139
'68.##5.105.17':139
'68.##5.93.18':139
'68.##5.207.48':139
'68.##5.104.199':139
'68.##5.182.62':139
'68.##5.216.104':139
'68.##5.129.126':139
'68.##5.67.212':445
'68.##5.70.127':445
'68.#55.18.1':445
'68.##5.216.4':445
'68.##5.100.191':139
'68.##5.200.230':445
'68.##5.107.77':445
'68.##5.129.126':445
'68.##5.182.71':445
'68.##5.228.231':445
'68.##5.17.46':445
'68.##5.77.189':445
'68.##5.190.254':445
'68.##5.182.62':445
'68.##5.93.18':445
'68.##5.20.246':445
'68.##5.240.169':445
'68.##5.29.101':139
'68.##5.197.202':445
'68.##5.191.107':139
'68.##5.34.61':445
'68.#55.1.89':139
'68.##5.216.4':139
'68.##5.240.169':139
'68.##5.11.81':139
'68.##5.190.254':139
'68.##5.170.33':139
'68.##5.250.156':139
'68.##5.26.10':139
'68.##5.197.202':139
'68.##5.17.46':139
'68.##5.34.61':139
'68.##5.145.216':139
'68.##5.172.120':9988
'68.##5.76.143':9988
'68.##5.33.93':9988
'68.##5.199.149':9988
'68.##5.80.73':9988
'68.##5.147.159':9988
'68.##5.167.78':9988
'68.#55.2.67':9988
'68.##5.191.110':9988
'68.##5.144.66':9988
'68.##5.254.173':139
'68.#55.18.1':139
'68.##5.64.32':139
'68.##5.228.30':139
'68.##5.31.16':139
'68.##5.54.199':139
'68.##5.175.188':139
'68.##5.200.230':139
'68.##5.254.1':139
'68.##5.228.231':139
'68.##5.20.246':139
'68.##5.107.77':139
'68.##5.222.71':139
'68.##5.106.249':139
'68.##5.88.182':139
'68.##5.211.196':139
'68.##5.248.159':139
'68.##5.84.254':139
'68.##5.67.212':139
'68.##5.16.99':139
'68.##5.240.55':139
'68.##5.196.51':445
'68.##5.112.124':139
'68.##5.159.234':139
'68.##5.233.77':139
'68.##5.221.230':139
'68.##5.135.24':139
'68.##5.204.67':139
'68.##5.110.135':139
'68.##5.177.89':139
'68.##5.240.176':139
'68.##5.3.199':139
'68.##5.235.38':139
'68.##5.65.245':139
'68.##5.214.3':139
'68.##5.200.114':139
'68.##5.6.185':139
'68.##5.56.132':139
'68.##5.61.159':139
'68.##5.222.243':445
'68.##5.252.173':139
'68.##5.131.236':139
'68.##5.127.59':139
'68.##5.47.127':445
'68.##5.184.77':445
'68.##5.125.56':445
'68.##5.252.173':445
'68.##5.240.176':445
'68.##5.134.241':445
'68.##5.160.32':445
'68.##5.24.26':445
'68.##5.251.145':445
'68.##5.141.201':445
'68.##5.56.132':445
'68.##5.239.226':139
'68.##5.125.56':139
'68.##5.230.224':139
'68.##5.120.207':139
'68.##5.12.98':139
'68.##5.237.61':445
'68.##5.205.63':445
'68.##5.47.127':139
'68.##5.14.117':139
'68.##5.70.16':139
'68.##5.205.63':139
'68.##5.54.199':445
'68.##5.31.16':445
'68.##5.254.1':445
'68.##5.106.249':445
'68.##5.129.148':445
'68.##5.222.243':139
'68.##5.65.197':445
'68.##5.104.199':445
'68.##5.88.182':445
'68.##5.74.12':139
'68.##5.84.254':445
'68.##5.65.197':139
'68.##5.228.30':445
'68.##5.16.99':445
'68.##5.105.17':445
'68.##5.159.205':445
'68.##5.64.32':445
'68.##5.254.173':445
'68.##5.216.104':445
'68.##5.248.159':445
'68.##5.207.48':445
'68.##5.24.191':139
'68.##5.212.109':139
'68.##5.109.178':139
'68.##5.100.191':445
'68.##5.170.212':139
'68.##5.49.246':139
'68.##5.98.161':139
'68.##5.78.170':139
'68.##5.74.12':445
'68.##5.179.52':139
'68.##5.29.101':445
'68.##5.3.181':139
'68.##5.134.241':139
'68.##5.251.145':139
'68.##5.184.77':139
'68.##5.141.201':139
'68.##5.254.25':139
'68.##5.191.107':445
'68.##5.186.156':139
'68.##5.24.26':139
'68.##5.160.32':139
'68.##5.125.173':9988
'68.##5.151.164':139
'68.##5.168.147':139
'68.#55.2.67':139
'68.##5.213.27':139
'68.##5.147.159':139
'68.##5.144.66':139
'68.##5.199.149':139
'68.##5.81.30':139
'68.##5.191.110':139
'68.##5.141.20':139
'68.##5.116.139':139
'68.##5.60.135':139
'68.##5.147.195':139
'68.##5.167.78':139
'68.##5.125.173':139
'68.##5.39.116':139
'68.##5.13.239':139
'68.##5.94.17':139
'68.#55.74.6':139
'68.##5.39.191':139
'68.##5.106.18':139
'68.##5.235.96':445
'68.##5.229.78':445
'68.##5.60.94':445
'68.##5.173.243':445
'68.##5.36.49':445
'68.##5.155.12':445
'68.#55.8.30':445
'68.##5.168.171':445
'68.##5.166.79':445
'68.##5.73.143':445
'68.##5.77.116':445
'68.##5.79.132':445
'68.##5.57.87':445
'68.##5.81.79':445
'68.##5.33.93':139
'68.##5.120.31':445
'68.##5.39.129':445
'68.##5.73.115':445
'68.##5.74.253':445
'68.##5.210.141':445
'68.##5.119.51':445
'68.##5.232.228':139
'68.##5.173.243':139
'68.##5.36.49':139
'68.##5.155.12':139
'68.##5.73.115':139
'68.##5.210.141':139
'68.##5.235.96':139
'68.##5.229.78':139
'68.##5.60.94':139
'68.##5.128.29':139
'68.##5.195.122':139
'68.##5.6.180':139
'68.##5.52.31':139
'68.##5.57.87':139
'68.##5.79.132':139
'68.##5.120.31':139
'68.##5.81.79':139
'68.##5.73.143':139
'68.##5.39.129':139
'68.##5.77.116':139
'68.##5.74.253':139
'68.##5.119.51':139
'68.##5.28.72':139
'68.##5.143.73':139
'68.##5.80.73':139
'68.#55.2.35':139
'68.##5.34.62':139
'68.##5.94.148':139
'68.##5.109.13':139
'68.##5.14.55':139
'68.##5.167.47':139
'68.#55.4.22':139
'68.##5.172.120':139
'68.##5.197.33':139
'68.##5.240.140':139
'68.##5.179.180':139
'68.##5.166.79':139
'68.##5.10.77':139
'68.##5.87.53':139
'68.##5.31.165':139
'68.#55.8.30':139
'68.##5.76.143':139
'68.##5.168.171':139
'68.##5.167.47':445
'68.##5.39.116':9988
'68.##5.147.195':9988
'68.##5.39.129':9988
'68.##5.57.87':9988
'68.##5.120.31':9988
'68.##5.73.143':9988
'68.##5.235.96':9988
'68.##5.79.132':9988
'68.##5.106.18':9988
'68.##5.232.228':9988
'68.##5.143.73':9988
'68.##5.28.72':9988
'68.##5.195.122':9988
'68.##5.10.77':9988
'68.##5.33.93':445
'68.##5.168.171':9988
'68.##5.197.33':9988
'68.#55.2.35':9988
'68.##5.39.191':9988
'68.##5.13.239':9988
'68.##5.116.139':9988
'68.##5.6.180':9988
'68.##5.81.30':9988
'68.##5.94.17':9988
'68.##5.31.165':9988
'68.#55.8.30':9988
'68.##5.94.148':9988
'68.##5.34.62':9988
'68.#55.74.6':9988
'68.##5.213.27':9988
'68.##5.151.164':9988
'68.##5.128.29':9988
'68.##5.167.47':9988
'68.##5.119.51':9988
'68.##5.173.243':9988
'68.##5.73.115':9988
'68.##5.60.135':9988
'68.##5.155.12':9988
'68.##5.77.116':9988
'68.##5.141.20':9988
'68.#55.4.22':9988
'68.##5.14.55':9988
'68.##5.199.149':445
'68.##5.143.73':445
'68.##5.87.53':445
'68.##5.172.120':445
'68.##5.76.143':445
'68.##5.52.31':445
'68.##5.125.173':445
'68.##5.28.72':445
'68.#55.2.35':445
'68.##5.34.62':445
'68.##5.31.165':445
'68.##5.240.140':445
'68.##5.6.180':445
'68.#55.4.22':445
'68.##5.197.33':445
'68.##5.10.77':445
'68.##5.109.13':445
'68.##5.14.55':445
'68.##5.94.148':445
'68.##5.195.122':445
'68.##5.128.29':445
'68.##5.179.180':445
'68.##5.147.159':445
'68.##5.191.110':445
'68.##5.213.27':445
'68.##5.116.139':445
'68.#55.2.67':445
'68.##5.144.66':445
'68.##5.151.164':445
'68.##5.168.147':445
'68.##5.141.20':445
'68.##5.81.30':445
'68.##5.39.116':445
'68.##5.39.191':445
'68.##5.147.195':445
'68.##5.13.239':445
'68.##5.80.73':445
'68.##5.167.78':445
'68.##5.94.17':445
'68.##5.232.228':445
'68.##5.106.18':445
'68.##5.60.135':445
'68.#55.74.6':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial