Trojan.Siggen13.1712

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\wmiprvse
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\mdm
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\smss

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
C:\users\public\kr9q118tpr
C:\users\public\nflxmifgtk
C:\users\public\hn2srdspoa
C:\users\public\prjpj6jzsw
C:\users\public\ssptgnbi5p
C:\users\public\fizz2sv8r3
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\886983d96e3d3e31032c679b2d4ea91b6c05afef
C:\users\public\wazy4kcb3v
C:\users\public\ujgvnlltbv
C:\users\public\gfxcovmifr
C:\users\public\cqkbpajomx
C:\users\public\ymrjovnhxs
C:\users\public\jgyn2edg2k
C:\users\public\r6ebne8ffn
%WINDIR%\syswow64\runonce\winlogon.exe
%WINDIR%\syswow64\runonce\cc11b995f2a76da408ea6a601e682e64743153ad
%ALLUSERSPROFILE%\mozilla\logs\24dbde2999530ef5fd907494bc374d663924116c
%ALLUSERSPROFILE%\mozilla\logs\wmiprvse.exe
%WINDIR%\syswow64\cryptnet\69ddcba757bf72f7d36c464c71f42baab150b2b9
%WINDIR%\syswow64\noise\winlogon.exe
%WINDIR%\syswow64\noise\cc11b995f2a76da408ea6a601e682e64743153ad
%ProgramFiles(x86)%\steam\steamapps\wmiprvse.exe
%ProgramFiles(x86)%\steam\steamapps\24dbde2999530ef5fd907494bc374d663924116c
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\dwm.exe
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\6cb0b6c459d5d3455a3da700e713f2e2529862ff
C:\users\public\b7qn63xoyd
C:\users\public\jbjhv4fktq
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\csrss.exe
C:\perflogs\admin\559fba5f8e44108851927af432f0edac6117c574
%ProgramFiles(x86)%\k-lite codec pack\info\winlogon.exe
%ProgramFiles(x86)%\k-lite codec pack\info\cc11b995f2a76da408ea6a601e682e64743153ad
<Current directory>\audiodg.exe
<Current directory>\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
%WINDIR%\syswow64\cryptnet\smss.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
C:\perflogs\admin\mdm.exe
C:\users\public\ievwhwrhiv

Deletes the following files

C:\users\public\kr9q118tpr
C:\users\public\nflxmifgtk
C:\users\public\hn2srdspoa
C:\users\public\prjpj6jzsw
C:\users\public\ssptgnbi5p
C:\users\public\fizz2sv8r3
C:\users\public\wazy4kcb3v
C:\users\public\jbjhv4fktq
C:\users\public\ujgvnlltbv
C:\users\public\gfxcovmifr
C:\users\public\cqkbpajomx
C:\users\public\ymrjovnhxs
C:\users\public\jgyn2edg2k
C:\users\public\r6ebne8ffn
C:\users\public\b7qn63xoyd
C:\users\public\ievwhwrhiv

Network activity

Connects to

'cu####3.tmweb.ru':80
'ip##fo.io':443

TCP

HTTP GET requests

http://cu####3.tmweb.ru/Videopipe.php?Ya#########################################################################################################################################################...
http://cu####3.tmweb.ru/Videopipe.php?Ya#############################################################################################################

'ip##fo.io':443

UDP

DNS ASK cu####3.tmweb.ru
DNS ASK ip##fo.io

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\runonce\winlogon.exe'

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\NOISE\winlogon.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Steam\steamapps\WmiPrvSE.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\mdm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\K-Lite Codec Pack\Info\winlogon.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'<Current directory>\audiodg.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<SYSTEM32>\cryptnet\smss.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Mozilla\logs\WmiPrvSE.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\runonce\winlogon.exe'" /rl HIGHEST /f