Trojan.DownLoader26.49937

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'regtlibs' = '%APPDATA%\URTTemp\regtlibs.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\teamviewervpn] 'ImagePath' = 'system32\DRIVERS\teamviewervpn.sys'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\URTTemp\regtlibs.exe' = '%APPDATA%\URTTemp\regtlibs.exe:*:En...

Modifies file system:

Creates the following files:

%TEMP%\nsk2.tmp\System.dll
%APPDATA%\URTTemp\x64\install64.exe
%APPDATA%\URTTemp\regtlibs.exe
%APPDATA%\URTTemp\TeamViewer_Desktop.exe
%APPDATA%\URTTemp\tv_w32.exe
%APPDATA%\URTTemp\tv_x64.exe
%APPDATA%\URTTemp\avicap32.dll
%APPDATA%\URTTemp\tv_w32.dll
%TEMP%\nsk2.tmp\ns3.tmp
%APPDATA%\URTTemp\tv_x64.dll
%APPDATA%\URTTemp\x86\teamviewervpn.sys
%APPDATA%\URTTemp\x64\teamviewervpn.sys
%APPDATA%\URTTemp\regtlibs.lnk
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%WINDIR%\inf\oem3.inf
%APPDATA%\URTTemp\x86\install.exe
%APPDATA%\URTTemp\scankey.pg
%APPDATA%\URTTemp\rdw.pg
%APPDATA%\URTTemp\installvpn.pg
%APPDATA%\URTTemp\x86\TeamViewerVPN.inf
%APPDATA%\URTTemp\x64\TeamViewerVPN.inf
%APPDATA%\URTTemp\tv.cfg
%APPDATA%\URTTemp\x64\teamviewervpn.cat
%APPDATA%\URTTemp\x86\teamviewervpn.cat
%APPDATA%\URTTemp\TeamViewer_Resource_en.dll
%TEMP%\nsk2.tmp\nsExec.dll
%TEMP%\nsk2.tmp\sl
%TEMP%\nsk2.tmp\StdUtils.dll
%TEMP%\nod.jpg
%TEMP%\kaspersky.jpg
%TEMP%\settings.ini
%TEMP%\nsk2.tmp\nsisFile.dll
%WINDIR%\inf\oem3.PNF
<DRIVERS>\SET6.tmp

Sets the 'hidden' attribute to the following files:

%APPDATA%\URTTemp\avicap32.dll
%APPDATA%\URTTemp\regtlibs.exe
%APPDATA%\URTTemp\TeamViewer_Resource_en.dll
%APPDATA%\URTTemp\tv.cfg
%APPDATA%\URTTemp\TeamViewer_Desktop.exe
%APPDATA%\URTTemp\tv_w32.exe
%APPDATA%\URTTemp\tv_x64.exe
%APPDATA%\URTTemp\tv_w32.dll
%APPDATA%\URTTemp\tv_x64.dll
%APPDATA%\URTTemp\installvpn.pg
%APPDATA%\URTTemp\rdw.pg
%APPDATA%\URTTemp\scankey.pg
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Deletes the following files:

%TEMP%\nsk2.tmp\ns3.tmp
%TEMP%\kaspersky.jpg
%TEMP%\nod.jpg
%APPDATA%\URTTemp\regtlibs.lnk
%TEMP%\settings.ini
%TEMP%\nsk2.tmp\nsExec.dll
%TEMP%\nsk2.tmp\nsisFile.dll
%TEMP%\nsk2.tmp\sl
%TEMP%\nsk2.tmp\StdUtils.dll
%TEMP%\nsk2.tmp\System.dll
%APPDATA%\URTTemp\rdw.pg

Moves the following files:

from <DRIVERS>\SET6.tmp to <DRIVERS>\teamviewervpn.sys

Network activity:

Connects to:

'localhost':1041
'pi###.#eamviewer.com':5938
'pi###.#eamviewer.com':443
'pi###.#eamviewer.com':80
'ma#####.teamviewer.com':80

TCP:

HTTP GET requests:

http://pi###.#eamviewer.com/din.aspx?s=#####################################################
http://ma#####.teamviewer.com/din.aspx?s=####################################################
http://pi###.#eamviewer.com/din.aspx?s=####################################################
http://ma#####.teamviewer.com/din.aspx?s=#####################################################

UDP:

DNS ASK pi###.#eamviewer.com
DNS ASK ma#####.teamviewer.com
DNS ASK ma#####0.teamviewer.com
DNS ASK ma#####1.teamviewer.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'TeamViewer Manager'

Creates and executes the following:

'%TEMP%\nsk2.tmp\ns3.tmp' "%TEMP%\nsk2.tmp\sl" x -p0916EDB32B63DD78EC5CC172C86BEF54B59BB6BDF32BFB38891A03A26FAD6FC06CFAC6C072AB1B8C3662B256710DFCC7671667B8AE6504B336EF04BB868F7428 "%TEMP%\kaspersky.jpg" "-o%APPDATA%"
'%TEMP%\nsk2.tmp\sl' x -p0916EDB32B63DD78EC5CC172C86BEF54B59BB6BDF32BFB38891A03A26FAD6FC06CFAC6C072AB1B8C3662B256710DFCC7671667B8AE6504B336EF04BB868F7428 "%TEMP%\kaspersky.jpg" "-o%APPDATA%"
'%APPDATA%\URTTemp\regtlibs.exe'
'%APPDATA%\URTTemp\x86\install.exe' -r install %APPDATA%\URTTemp\x86\TeamViewerVPN.inf teamviewervpn

Executes the following: