Trojan.Siggen32.22294

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\<File name>abgbmnn.lnk

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /t /im Idle.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im RtkAudio.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im screen.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im Systemfont.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im IntelSvc.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im xmrig.exe
'%WINDIR%\syswow64\taskkill.exe' /f /t /im FixT3N24.cmd
'%WINDIR%\syswow64\taskkill.exe' /f /t /im FixT3N24.txt
'%WINDIR%\syswow64\taskkill.exe' /f /t /im SwithMail.exe
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 25" dir=out action=block protocol=TCP localport=25
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 465" dir=out action=block protocol=TCP localport=465
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 587" dir=out action=block protocol=TCP localport=587
'%WINDIR%\syswow64\taskkill.exe' /f /im Idle.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im AnyDesk.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im RtkAudio.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im RuntimeBroker.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im cmdow.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im tv_x86.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im screen.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im Systemfont.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im IntelSvc.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im xmrig.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im FixT3N24.cmd
'%WINDIR%\syswow64\taskkill.exe' /f /im FixT3N24.txt
'%WINDIR%\syswow64\taskkill.exe' /f /im SwithMail.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\runtimebroker.exe

Modifies file system

Creates the following files

<Current directory>\all_rtk_clear_ok.bat
<Current directory>\all_rtk_clear_ok_admin2.bat
D:\alfares\data\all_rtk_clear_ok_admin.txt
nul
<Current directory>\attempting
<Current directory>\all_rtk_clear_ok.txt

Modifies the HOSTS file.

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok_admin2.bat"
'%WINDIR%\syswow64\net.exe' session
'%WINDIR%\syswow64\net1.exe' session
'%WINDIR%\syswow64\schtasks.exe' /query /tn "Svtasks"
'%WINDIR%\syswow64\schtasks.exe' /query /tn "FixT3N24"
'%WINDIR%\syswow64\sc.exe' query WinRing0_1_2_0
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled"
'%WINDIR%\syswow64\attrib.exe' -r -h -s "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\takeown.exe' /f "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant administrators:F
'%WINDIR%\syswow64\findstr.exe' /i "xemhang.vn" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "sancovat.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "emailserver.vn" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "pro13.emailserver.vn" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "auto.c3pool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "c3pool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "pool.c3pool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "xmr.2miners.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "2miners.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "pool.2miners.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "xmrpool.eu" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "supportxmr.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "minexmr.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "nanopool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "xmr-eu1.nanopool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "xmr-eu2.nanopool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "www.xemhang.vn" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "www.sancovat.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "eu1.solopool.org" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "sg.monero.herominers.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "de.monero.herominers.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "moneropool.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "GHhA5Joo.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\findstr.exe' /i "xmr.GHhA5Joo.com" "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\attrib.exe' +r "<DRIVERS>\etc\hosts"
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\find.exe' /i "AnyDesk.exe"
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" 2>nul
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Start "
'%WINDIR%\syswow64\findstr.exe' /i "anydesk radmin zerotier defender securityhealth"
'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok.bat"
'%WINDIR%\syswow64\sc.exe' query "Service Network"
'%WINDIR%\syswow64\sc.exe' query "RuntimeBroker"
'%WINDIR%\syswow64\sc.exe' query "RtkAudio"
'%WINDIR%\syswow64\sc.exe' query "IntelSvc"
'%WINDIR%\syswow64\sc.exe' query "Systemfont"
'%WINDIR%\syswow64\sc.exe' query "WinRing0x64"
'%WINDIR%\syswow64\sc.exe' query "svtasks"
'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok_admin2.bat"' (with hidden window)