Trojan.BankBot.1067

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'ImagePath' = '%ALLUSERSPROFILE%\Google\Chrome\updater.exe'
[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\bldjmcwaojrx.sys'

Creates the following services

'GoogleUpdateTaskMachineQC' %ALLUSERSPROFILE%\Google\Chrome\updater.exe
'WinRing0_1_2_0' %WINDIR%\TEMP\bldjmcwaojrx.sys

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\dialer.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\dwm.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\wudfhost.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\sihost.exe
<SYSTEM32>\taskhostw.exe
%WINDIR%\explorer.exe
<SYSTEM32>\runtimebroker.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\securityhealthsystray.exe
<SYSTEM32>\oobe\useroobebroker.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\conhost.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\wusa.exe
<SYSTEM32>\wbem\wmiprvse.exe

the following user processes:

iexplore.exe
firefox.exe
updater.exe

Hooks functions

in browsers

firefox.exe process, advapi32.dll module
iexplore.exe process, advapi32.dll module

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\dialer.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\google\chrome\updater.exe
%WINDIR%\temp\__psscriptpolicytest_1xwzekgo.l0q.ps1
%WINDIR%\temp\__psscriptpolicytest_a3tjeic3.hia.psm1
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-43-171.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-43-958.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-135.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-327.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-359.dump
%WINDIR%\temp\__psscriptpolicytest_uyck1lfk.1h4.ps1
%WINDIR%\temp\__psscriptpolicytest_hbj23cpd.vua.psm1
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-655.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-734.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-44-861.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-078.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-277.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-393.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-599.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-870.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-45-956.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-46-059.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-46-259.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-46-356.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-46-704.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-268.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-571.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-706.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-709.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-726.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-799.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-48-856.dump
%WINDIR%\temp\content\3968-224-powershell.exe-23-17-49-128.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\bldjmcwaojrx.sys

Network activity

Connects to

'gu##.##neroocean.stream':10128

TCP

Other

'gu##.##neroocean.stream':10128

UDP

DNS ASK gu##.##neroocean.stream

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\google\chrome\updater.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\dialer.exe'
'<SYSTEM32>\sc.exe' delete "GoogleUpdateTaskMachineQC"
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\Google\Chrome\updater.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "GoogleUpdateTaskMachineQC"