Trojan.Siggen31.44252

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\yHjTLMyYIdH] 'ImagePath' = '<DRIVERS>\7Wq2ESyBCfKY.sys'
[HKLM\System\CurrentControlSet\Services\jFdNP2bo1ya16] 'ImagePath' = '<DRIVERS>\tznMudADMDe.zab'
[HKLM\System\CurrentControlSet\Services\i4eSF5rZrxHgrt] 'ImagePath' = '<SYSTEM32>\ZziSMRqTbmm.sys'
[HKLM\System\CurrentControlSet\Services\vWLeYiO85BL] 'ImagePath' = '<SYSTEM32>\5dUxXJAEanyHO.nnw'
[HKLM\System\CurrentControlSet\Services\V2Nm8metYPBU] 'ImagePath' = '%WINDIR%\C0WY4EYMB2ky.sys'
[HKLM\System\CurrentControlSet\Services\MIC4m7V7d1D] 'ImagePath' = '<DRIVERS>\EKXSBjQnAVv1Ip.sys'
[HKLM\System\CurrentControlSet\Services\TStvIo] 'ImagePath' = '<DRIVERS>\6jyTsu6v.sys'
[HKLM\System\CurrentControlSet\Services\M7hNeQPD0PF] 'ImagePath' = '<DRIVERS>\3CiSGiRqzc.sys'

Creates the following services

'yHjTLMyYIdH' <DRIVERS>\7Wq2ESyBCfKY.sys
'jFdNP2bo1ya16' <DRIVERS>\tznMudADMDe.zab
'i4eSF5rZrxHgrt' <SYSTEM32>\ZziSMRqTbmm.sys
'vWLeYiO85BL' <SYSTEM32>\5dUxXJAEanyHO.nnw
'V2Nm8metYPBU' %WINDIR%\C0WY4EYMB2ky.sys
'MIC4m7V7d1D' <DRIVERS>\EKXSBjQnAVv1Ip.sys
'TStvIo' <DRIVERS>\6jyTsu6v.sys
'M7hNeQPD0PF' <DRIVERS>\3CiSGiRqzc.sys

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe
firefox.exe
schtasks.exe

Hooks functions

in browsers

firefox.exe process, nss3.dll module
firefox.exe process, wininet.dll module
firefox.exe process, mswsock.dll module

Modifies file system

Creates the following files

%WINDIR%\syswow64\drivers\7wq2esybcfky.sys
%WINDIR%\syswow64\drivers\tznmudadmde.zab
%WINDIR%\syswow64\zzismrqtbmm.sys
%WINDIR%\syswow64\5duxxjaeanyho.nnw
%WINDIR%\c0wy4eymb2ky.sys
%WINDIR%\fonts\schtasks.exe
<DRIVERS>\ekxsbjqnavv1ip.sys
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\2nob1quhe.cat
<DRIVERS>\6jytsu6v.sys
<DRIVERS>\3cisgirqzc.sys
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1bdf65.cat
%WINDIR%\d3096\csrss.exe
%ProgramFiles%\microsoft sync framework\manifest.json
%ProgramFiles%\microsoft sync framework\260924.js
%ProgramFiles%\microsoft sync framework\2f8b6d.html
%ProgramFiles%\microsoft sync framework\390db6.js
%ProgramFiles%\microsoft sync framework\lib\428fff.js

Deletes the following files

%WINDIR%\syswow64\drivers\7wq2esybcfky.sys
%WINDIR%\syswow64\drivers\tznmudadmde.zab
%WINDIR%\syswow64\zzismrqtbmm.sys
%WINDIR%\syswow64\5duxxjaeanyho.nnw
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\2nob1quhe.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1bdf65.cat

Network activity

Connects to

'dn#.#lidns.com':443
'dn#.#lidns.com':80
'xc#.#ycsl.top':80
'ap##.#ame.qq.com':80
'sp#.#aidu.com':80
'xc#.#ycsl.top':443

TCP

HTTP GET requests

http://dn#.#lidns.com/resolve?na#######################
http://dn#.#lidns.com/resolve?na########################
http://xc#.#eaya.site/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip.md5.txt
http://xc#.#eaya.site/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip
http://xc#.#ycsl.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip.md5.txt
http://xc#.#ycsl.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip
http://xc#.#ycsl.top/cfg/cmc/ping.txt
http://xc#.#ycsl.top/cfg/cmc/userchange.txt
http://xc#.#ycsl.top/cfg/cmc/userpq.zip
http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
http://sp#.#aidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?qu############################################################
http://xc#.#ycsl.top/cfg/cmc/blacklist.txt
http://xc#.#ycsl.top/cfg/user/c995ec7fd4f57c0d/e691ad375852f8cd.json
http://xc#.#ycsl.top/cfg/pub/ms.json
http://xc#.#ycsl.top/cfg/pub/ps.json
http://xc#.#ycsl.top/pgm/mds/a7e45213b3380c84/77750770f7220a1d2c9db3a1a618e82c2fab028ae274d27864.zip
http://xc#.#ycsl.top/pgm/mds/263f90e315e63f39/b6fb7e65ccbfa9088f6118064d8ab9f8922ecedd4468fcd764.zip
http://xc#.#ycsl.top/pgm/mds/00ed36f35c33f9c5/be60c2ecfc190e4cf0fc9f7fe5b2f4cf811c04596514ee2064.zip
http://xc#.#ycsl.top/pgm/mds/21daadc79a923587/a117bad625beeffcddec38dbeb985e696c6f3f8ac75cda0564.zip
http://xc#.#ycsl.top/pgm/mds/fdd349d7eaf04acc/26a3a60a23f651b1081a33a6f0e71eee54328b36243992f464.zip
http://nr#.#ycsl.top/report/report_data?da#######################################################################################################################################################...
http://xc#.#ycsl.top/cfg/cmc/slfdm.txt
http://xc#.#ycsl.top/cfg/cmc/ppmldb
http://xc#.#ycsl.top/cfg/cmc/b2.txt
http://xc#.#ycsl.top/pgm/mds/f30c73dccf55f69e/0201f919f6e83121081a33a6f0e71eee09bb87916a55ba2564.zip
http://xc#.#ycsl.top/cfg/cmc/sfbd.txt
http://dn#.#lidns.com/resolve?na############
http://xc#.#ycsl.top/pgm/mds/890fbd89be47b7a4/9cd12d886d5d27933b350c0cdfc7c7bca94692aafccfc26c64.zip
http://dn#.#lidns.com/resolve?na###########
http://xc#.#ycsl.top/cfg/cmc/ggtbd.txt
http://xc#.#ycsl.top/cfg/cmc/oypass.txt
http://xc#.#ycsl.top/cfg/cmc/wea.txt
http://xc#.#ycsl.top/cfg/cmc/chct.txt
http://22#.5.5.5/resolve?na###########
http://dn#.#lidns.com/resolve?na###############

Other

'dn#.#lidns.com':443
'xc#.#ycsl.top':443

UDP

DNS ASK xc#.#ycsl.top
DNS ASK dn#.#lidns.com
DNS ASK xc#.#eaya.site
DNS ASK ap##.#ame.qq.com
DNS ASK sp#.#aidu.com
'23#.#23.112.211':51701
'23#.2.2.2':18804

Miscellaneous

Adds a root certificate

Creates and executes the following

'%WINDIR%\fonts\schtasks.exe'

Executes the following

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"