Trojan.BankBot.2191

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\dialersvc64

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\System] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\System] 'ImagePath' = '%ALLUSERSPROFILE%\System\System32.exe'

Creates the following services

'System' %ALLUSERSPROFILE%\System\System32.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Event Logging

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\dllhost.exe
<SYSTEM32>\dialer.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\dwm.exe
<SYSTEM32>\wudfhost.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\sihost.exe
<SYSTEM32>\taskhostw.exe
%WINDIR%\explorer.exe
<SYSTEM32>\runtimebroker.exe
<SYSTEM32>\securityhealthsystray.exe
<SYSTEM32>\oobe\useroobebroker.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\conhost.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\wbem\wmiprvse.exe

the following user processes:

iexplore.exe
firefox.exe
system32.exe

Hooks functions

in browsers

firefox.exe process, advapi32.dll module
iexplore.exe process, advapi32.dll module

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\dllhost.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\system\system32.exe
%WINDIR%\temp\__psscriptpolicytest_y2trd3gk.fq2.ps1
%WINDIR%\temp\__psscriptpolicytest_bzdhttvi.4zf.psm1
%WINDIR%\temp\__psscriptpolicytest_mprfugvn.bp1.ps1
%WINDIR%\temp\__psscriptpolicytest_vk0kkx0z.xpb.psm1
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-03-470.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-03-735.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-03-845.dump
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-03-856.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-025.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-056.dump
%WINDIR%\temp\__psscriptpolicytest_pddv0kcv.4hm.ps1
%WINDIR%\temp\__psscriptpolicytest_sj1yvvar.gqs.psm1
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-04-201.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-232.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-263.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-301.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-386.dump
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-04-417.dump
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-04-464.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-502.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-586.dump
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-04-602.dump
%WINDIR%\temp\content\4376-2044-powershell.exe-07-34-04-702.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-702.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-749.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-764.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-800.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-831.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-862.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-04-893.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-398.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-525.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-573.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-587.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-687.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-725.dump
%WINDIR%\temp\content\4560-5360-powershell.exe-07-34-05-911.dump
%WINDIR%\temp\zirdlhkhdrrx.sys
%WINDIR%\temp\__psscriptpolicytest_u23jjebn.ll4.ps1
%WINDIR%\temp\__psscriptpolicytest_ihkueydp.kil.psm1
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-11-463.dump
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-11-813.dump
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-12-030.dump
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-12-077.dump
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-12-216.dump
%WINDIR%\temp\content\2808-1776-powershell.exe-07-34-12-294.dump

Deletes following files that it created itself

%WINDIR%\temp\__psscriptpolicytest_y2trd3gk.fq2.ps1
%WINDIR%\temp\__psscriptpolicytest_bzdhttvi.4zf.psm1
%WINDIR%\temp\__psscriptpolicytest_mprfugvn.bp1.ps1
%WINDIR%\temp\__psscriptpolicytest_vk0kkx0z.xpb.psm1
%WINDIR%\temp\__psscriptpolicytest_pddv0kcv.4hm.ps1
%WINDIR%\temp\__psscriptpolicytest_sj1yvvar.gqs.psm1
<SYSTEM32>\tasks\dialersvc64
%WINDIR%\temp\__psscriptpolicytest_u23jjebn.ll4.ps1
%WINDIR%\temp\__psscriptpolicytest_ihkueydp.kil.psm1

Network activity

Connects to

'xm#####.nanopool.org':14433

TCP

Other

'xm#####.nanopool.org':14433

UDP

DNS ASK xm#####.nanopool.org

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\system\system32.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\dialer.exe'
'<SYSTEM32>\sc.exe' delete "System"
'<SYSTEM32>\sc.exe' create "System" binpath= "%ALLUSERSPROFILE%\System\System32.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "System"
'<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
'<SYSTEM32>\dllhost.exe' /Processid:{ad7c2cad-17e8-4c9c-b756-87952c89c92d}
'<SYSTEM32>\dllhost.exe' /Processid:{ae0f7a51-cf8f-4cae-b286-39c3a6b97858}