Trojan.BankBot.542

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\MdS8yDaphwdtK] 'ImagePath' = '<DRIVERS>\EtZ2m81mNyG4ww.sys'
[HKLM\System\CurrentControlSet\Services\3RNMzq7ZaGi52s] 'ImagePath' = '<DRIVERS>\WKJTasJBmtZd7.gyz'
[HKLM\System\CurrentControlSet\Services\mbdXXAF9vqO] 'ImagePath' = '<SYSTEM32>\39X3WdcSSw.sys'
[HKLM\System\CurrentControlSet\Services\W7md6eTafaA] 'ImagePath' = '<SYSTEM32>\bJRCFqlIKBa.oyx'
[HKLM\System\CurrentControlSet\Services\ZqkojlzoCl] 'ImagePath' = '%WINDIR%\iEaJosGWQzXF9F.sys'
[HKLM\System\CurrentControlSet\Services\WVGxrCR2tm4ZZ] 'ImagePath' = '<DRIVERS>\9o0giScnui.sys'
[HKLM\System\CurrentControlSet\Services\u42NS9bU] 'ImagePath' = '<DRIVERS>\HeDcryd.sys'
[HKLM\System\CurrentControlSet\Services\B5N7rSAXc7C] 'ImagePath' = '<DRIVERS>\AxduqgDgtND91.sys'

Creates the following services

'MdS8yDaphwdtK' <DRIVERS>\EtZ2m81mNyG4ww.sys
'3RNMzq7ZaGi52s' <DRIVERS>\WKJTasJBmtZd7.gyz
'mbdXXAF9vqO' <SYSTEM32>\39X3WdcSSw.sys
'W7md6eTafaA' <SYSTEM32>\bJRCFqlIKBa.oyx
'ZqkojlzoCl' %WINDIR%\iEaJosGWQzXF9F.sys
'WVGxrCR2tm4ZZ' <DRIVERS>\9o0giScnui.sys
'u42NS9bU' <DRIVERS>\HeDcryd.sys
'B5N7rSAXc7C' <DRIVERS>\AxduqgDgtND91.sys

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe
firefox.exe

Hooks functions

in browsers

firefox.exe process, mswsock.dll module
firefox.exe process, wininet.dll module
firefox.exe process, nss3.dll module

Modifies file system

Creates the following files

%WINDIR%\syswow64\drivers\etz2m81mnyg4ww.sys
%WINDIR%\syswow64\drivers\wkjtasjbmtzd7.gyz
%WINDIR%\syswow64\39x3wdcssw.sys
%WINDIR%\syswow64\bjrcfqlikba.oyx
%WINDIR%\ieajosgwqzxf9f.sys
%WINDIR%\inf\hostname.exe
<DRIVERS>\9o0giscnui.sys
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\kunag4u.cat
<DRIVERS>\hedcryd.sys
<DRIVERS>\axduqgdgtnd91.sys
%ProgramFiles%\windows defender\manifest.json
%ProgramFiles%\windows defender\385704.js
%ProgramFiles%\windows defender\466cc5.html
%ProgramFiles%\windows defender\548286.js
%ProgramFiles%\windows defender\lib\629847.js
%WINDIR%\81eb3\csrss.exe

Deletes the following files

%WINDIR%\syswow64\drivers\etz2m81mnyg4ww.sys
%WINDIR%\syswow64\drivers\wkjtasjbmtzd7.gyz
%WINDIR%\syswow64\39x3wdcssw.sys
%WINDIR%\syswow64\bjrcfqlikba.oyx

Deletes itself.

Network activity

Connects to

'dn#.#lidns.com':443
'dn#.#lidns.com':80
'12#.#89.171.107':80
'ap##.#ame.qq.com':80
'sp#.#aidu.com':80
'12#.#89.171.107':443
'oc##.##ust-provider.cn':80

TCP

HTTP GET requests

http://dn#.#lidns.com/resolve?na#######################
http://xc#.#cslw.top/cfg/cmc/slfdm.txt
http://xc#.#cslw.top/cfg/cmc/qzpass.txt
http://xc#.#cslw.top/cfg/cmc/b2.txt
http://xc#.#cslw.top/pgm/mds/b3abb02528414f5a/6188d79c9fc7cdae7c70c674799b20d564.zip
http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRK6%2BKMEm7xEAA7oRlXypSzGx%2FAgQUyPPFCRszol%2BmEquQ1gC2XPyNHAYCEFjJ5Z0VGk%2Fu62Kowy9UMAQ%3D
http://nr#.#cslw.top/report/report_data?da#######################################################################################################################################################...
http://xc#.#cslw.top/cfg/cmc/ppmldb
http://xc#.#cslw.top/cfg/cmc/ggtbd.txt
http://dn#.#lidns.com/resolve?na######################
http://22#.5.5.5/resolve?na######################
http://dn#.#lidns.com/resolve?na####################
http://xc#.#cslw.top/pgm/mds/422ed73a26bc994c/a46c24a265a3bec7ba11a948e142f17e7791d60165ab87c464.zip
http://xc#.#cslw.top/cfg/cmc/sfbd.txt
http://dn#.#lidns.com/resolve?na###################
http://dn#.#lidns.com/resolve?na########################
http://xc#.#cslw.top/pgm/mds/a78ecda18e438473/49e1ec46b8e1374f99cc864009781c3d56877b12ce5518a964.zip
http://xc#.#cslw.top/pgm/mds/71600c65a728333a/c57d344613ba8549426e5dbea86f249c6c935a8eac4509a264.zip
http://xc#.#cslw.top/pgm/mds/186dc678628340ee/219c906140f2c06be2e3db6296e78091a34c8da1c928895b64.zip
http://xc#.#cslw.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip
http://xc#.#cslw.top/cfg/cmc/ping.txt
http://xc#.#cslw.top/cfg/cmc/userchange.txt
http://xc#.#cslw.top/cfg/cmc/userpq.zip
http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
http://sp#.#aidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?qu###############################################################
http://xc#.#cslw.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip.md5.txt
http://xc#.#cslw.top/cfg/cmc/blacklist.txt
http://xc#.#cslw.top/cfg/pub/ms.json
http://xc#.#cslw.top/cfg/pub/ps.json
http://xc#.#cslw.top/pgm/mds/05631e93ccdb00ee/1d3049b187ce606623cd71ca2f04529ace43d0e0c871205264.zip
http://xc#.#cslw.top/pgm/mds/8a535297eaa802d1/17d0ec639db40991bbe7c285bb4fe48e0f26e9808f1e227964.zip
http://xc#.#cslw.top/pgm/mds/62761afc2f0d796a/a4fa2c8d00fc0abae2e3db6296e78091112c7b6cfbdbf26a64.zip
http://xc#.#cslw.top/pgm/mds/865609897d54b79b/2cc3b5fea2ff6d3e64a0bc664100d6ddc4135e436bb0669a64.zip
http://xc#.#cslw.top/cfg/user/c995ec7fd4f57c0d/e691ad375852f8cd.json
http://xc#.#cslw.top/cfg/cmc/wea.txt
http://xc#.#cslw.top/cfg/cmc/chct.txt

Other

'dn#.#lidns.com':443
'12#.#89.171.107':443

UDP

DNS ASK xc#.#ycsl.top
DNS ASK dn#.#lidns.com
DNS ASK xc#.#cslw.top
DNS ASK ap##.#ame.qq.com
DNS ASK sp#.#aidu.com
DNS ASK oc##.##ust-provider.cn
'23#.#23.112.211':51701
'23#.2.2.2':18804

Miscellaneous

Adds a root certificate

Creates and executes the following

'%WINDIR%\inf\hostname.exe'
'%WINDIR%\81eb3\csrss.exe'

Executes the following

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\inf\hostname.exe"
'%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"
'%WINDIR%\syswow64\timeout.exe' /t 1
'%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"' (with hidden window)