Trojan.Hosts.44167

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jehangirimpulsively' = '"%ProgramFiles%\motility\pinafore.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'impulsivelyjehangir' = '"%ProgramFiles%\motility\pinafore.exe" 1XO'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jehangir' = '"%ProgramFiles%\Castrate\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'impulsivelyimpulsively' = '"%ProgramFiles%\Creasy\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'props' = '"%ProgramFiles%\Castrate\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'multilayered' = '"%ProgramFiles%\nurseries\multilayered.exe" 1XO'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jehangirjehangir' = '"%ProgramFiles%\Creasy\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'leaningcarboniferous' = '"%ProgramFiles%\motility\pinafore.exe" 1XO'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'carboniferous' = '"%ProgramFiles%\Castrate\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'leaning' = '"%ProgramFiles%\Castrate\phenoms.exe" 1XO'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'carboniferousleaning' = '"%ProgramFiles%\motility\pinafore.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'impulsively' = '"%ProgramFiles%\Castrate\phenoms.exe" 1XO'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'carboniferouscarboniferous' = '"%ProgramFiles%\Creasy\phenoms.exe" 1XO'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'leaningleaning' = '"%ProgramFiles%\Creasy\phenoms.exe" 1XO'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\taintain.lnk
%HOMEPATH%\Start Menu\Programs\Startup\tain.lnk

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[1].html
%TEMP%\nsqA.tmp\nsB.tmp
%TEMP%\nspE.tmp\ShellLink.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[1].html
%TEMP%\nsk7.tmp\AccessControl.dll
%ProgramFiles%\romain\romain.exe
%ProgramFiles%\nurseries\multilayered.exe
%TEMP%\nsqA.tmp\nsExec.dll
%WINDIR%\tring.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[7].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[6].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[8].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[10].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[9].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[2].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[3].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[5].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq[4].html
%TEMP%\nsc2.tmp\NMmeters.exe
%TEMP%\nsc2.tmp\124090.exe
%TEMP%\nsc2.tmp\Microsoft.Win32.TaskScheduler.dll
%ProgramFiles%\Castrate\Castrate.exe
%TEMP%\nsc2.tmp\113486.exe
%TEMP%\nsc2.tmp\41184.exe
%TEMP%\nsc2.tmp\14458.exe
%TEMP%\nsc2.tmp\54502.exe
%TEMP%\nsc2.tmp\78426.exe
%TEMP%\nsc2.tmp\108965.exe
<LS_APPDATA>\pinafore.exe
<LS_APPDATA>\phenoms.exe
%TEMP%\nsv5.tmp\SimpleFC.dll
%ProgramFiles%\Creasy\pinafore.exe
%ProgramFiles%\Creasy\phenoms.exe
%ProgramFiles%\Castrate\phenoms.exe
%ProgramFiles%\Castrate\phenoms.dll
%ProgramFiles%\motility\motility.exe
%ProgramFiles%\motility\pinafore.exe
%ProgramFiles%\motility\pinafore.dll

Deletes the following files:

%TEMP%\nspE.tmp\ShellLink.dll
%TEMP%\nsk7.tmp\AccessControl.dll
%TEMP%\nsv5.tmp\SimpleFC.dll

Modifies the HOSTS file.

Network activity:

Connects to:

'si###miramar.pw':80
'localhost':1045
'localhost':1038
'localhost':1036
'localhost':1037

TCP:

HTTP GET requests:

http://www.si###miramar.pw/bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq.html?Rk################### via si###miramar.pw
http://www.si###miramar.pw/bntf2cq0cq1cq8cq0hoaicp3hoaicp0bntf1bntfcq.html?Rk################## via si###miramar.pw

UDP:

DNS ASK www.si###miramar.pw

Miscellaneous:

Searches for the following windows:

ClassName: 'Chrome_WidgetWin_0' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Creates and executes the following:

'%TEMP%\nsc2.tmp\NMmeters.exe' "%ProgramFiles%\romain\romain.exe" "abs"
'%TEMP%\nsc2.tmp\113486.exe'
'%TEMP%\nsc2.tmp\NMmeters.exe' "%ProgramFiles%\Creasy\phenoms.exe" "inter_daringly"
'%TEMP%\nsc2.tmp\NMmeters.exe' "%ProgramFiles%\Creasy\pinafore.exe" "unleavened dazs"
'%ProgramFiles%\nurseries\multilayered.exe'
'%TEMP%\nsqA.tmp\nsB.tmp' taskkill /im chrome.exe
'%TEMP%\nsc2.tmp\108965.exe'
'%TEMP%\nsc2.tmp\54502.exe'
'%TEMP%\nsc2.tmp\78426.exe'
'%TEMP%\nsc2.tmp\124090.exe'
'%ProgramFiles%\Castrate\phenoms.exe' 1XO
'%TEMP%\nsc2.tmp\NMmeters.exe' "%ProgramFiles%\Castrate\phenoms.exe" "specs"
'%TEMP%\nsc2.tmp\NMmeters.exe' "%ProgramFiles%\motility\pinafore.exe" "aeneid-frankenstein"
'%TEMP%\nsc2.tmp\41184.exe'
'%ProgramFiles%\Creasy\phenoms.exe' 1XO
'%ProgramFiles%\Creasy\pinafore.exe' 1XO
'%TEMP%\nsc2.tmp\NMmeters.exe' "<LS_APPDATA>\phenoms.exe" "cauterized underpayment sebago"
'%TEMP%\nsc2.tmp\NMmeters.exe' "<LS_APPDATA>\pinafore.exe" "aryan_apiece"