Trojan.MulDrop11.19668

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\OCS Inventory Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\OCS Inventory Service] 'ImagePath' = '%ProgramFiles(x86)%\OCS Inventory Agent\OcsService.exe'

Modifies file system

Creates the following files

%TEMP%\ocspackage.log
%TEMP%\nsq137c.tmp\killprocdll.dll
%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.ini
%ProgramFiles(x86)%\ocs inventory agent\libcurl.dll
%ProgramFiles(x86)%\ocs inventory agent\libeay32.dll
%ProgramFiles(x86)%\ocs inventory agent\ssleay32.dll
%ProgramFiles(x86)%\ocs inventory agent\msvcp120.dll
%ProgramFiles(x86)%\ocs inventory agent\msvcr120.dll
%ProgramFiles(x86)%\ocs inventory agent\mfc120.dll
%ProgramFiles(x86)%\ocs inventory agent\mfc120u.dll
%ProgramFiles(x86)%\ocs inventory agent\mfcm120.dll
%ProgramFiles(x86)%\ocs inventory agent\mfcm120u.dll
%ProgramFiles(x86)%\ocs inventory agent\vcruntime140.dll
%ProgramFiles(x86)%\ocs inventory agent\vcomp140.dll
%ProgramFiles(x86)%\ocs inventory agent\vcamp140.dll
%ProgramFiles(x86)%\ocs inventory agent\ziparchive.dll
%ProgramFiles(x86)%\ocs inventory agent\zlib1.dll
%ProgramFiles(x86)%\ocs inventory agent\comhttp.dll
%ProgramFiles(x86)%\ocs inventory agent\uninst.exe
%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.log.bak
%PROGRAMDATA%\microsoft\windows\start menu\programs\startup\ocs inventory ng systray.lnk
%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.log
%ProgramFiles(x86)%\ocs inventory agent\ocs-transform.xsl
%ProgramFiles(x86)%\ocs inventory agent\ocssnmp.exe
%ProgramFiles(x86)%\ocs inventory agent\ocssystray.exe
%ProgramFiles(x86)%\ocs inventory agent\ocsnotifyuser.exe
%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe
%ProgramFiles(x86)%\ocs inventory agent\download.exe
%ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe
%ProgramFiles(x86)%\ocs inventory agent\ocsinventory front.dll
%ProgramFiles(x86)%\ocs inventory agent\sysinfo.dll
%ProgramFiles(x86)%\ocs inventory agent\ocswmi.dll
%PROGRAMDATA%\ocs inventory ng\agent\rand
%TEMP%\nsq137c.tmp\services.dll
%TEMP%\nsq137c.tmp\nsexec.dll
%TEMP%\nsq137c.tmp\userinfo.dll
%TEMP%\nsxa92.tmp\system.dll
%TEMP%\nsxa92.tmp\instocs.exe
%TEMP%\nsxa92.tmp\ocssetup.exe
%TEMP%\nsxa92.tmp\ocsdata\cacert.pem
%TEMP%\nsxa92.tmp\ocsplugins\networkshare.vbs
%TEMP%\nsxa92.tmp\ocsplugins\runningprocess.vbs
%TEMP%\nsxa92.tmp\ocsplugins\security.vbs
%TEMP%\nsxa92.tmp\ocsplugins\services.vbs
%TEMP%\nsxa92.tmp\ocsplugins\teamviewer.vbs
%TEMP%\nsxa92.tmp\ocsplugins\uptime.vbs
%TEMP%\nsxa92.tmp\ocsplugins\winusers.vbs
%TEMP%\nsxa92.tmp\ocsdat.ini
%TEMP%\nsxa92.tmp\userinfo.dll
%TEMP%\nsje2c.tmp\system.dll
%PROGRAMDATA%\ocs inventory ng\agent\cacert.pem
%ProgramFiles(x86)%\ocs inventory agent\plugins\networkshare.vbs
%ProgramFiles(x86)%\ocs inventory agent\plugins\runningprocess.vbs
%TEMP%\nsq137c.tmp\setacl.exe
%TEMP%\nsq137c.tmp\splash.bmp
%TEMP%\nsq137c.tmp\local.ini
%TEMP%\nsq137c.tmp\agent.ini
%TEMP%\nsq137c.tmp\proxy.ini
%TEMP%\nsq137c.tmp\server.ini
%TEMP%\nsxa92.tmp\ocs-ng-windows-agent-setup.log
%TEMP%\nsq137c.tmp\system.dll
%TEMP%\nsf1168.tmp
%ProgramFiles(x86)%\ocs inventory agent\plugins\winusers.vbs
%ProgramFiles(x86)%\ocs inventory agent\plugins\uptime.vbs
%ProgramFiles(x86)%\ocs inventory agent\plugins\teamviewer.vbs
%ProgramFiles(x86)%\ocs inventory agent\plugins\services.vbs
%ProgramFiles(x86)%\ocs inventory agent\plugins\security.vbs
%TEMP%\nsq137c.tmp\advsplash.dll
%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.dat

Deletes the following files

%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.log
%TEMP%\nsxa92.tmp\ocssetup.exe
%TEMP%\nsxa92.tmp\ocsplugins\winusers.vbs
%TEMP%\nsxa92.tmp\ocsplugins\uptime.vbs
%TEMP%\nsxa92.tmp\ocsplugins\teamviewer.vbs
%TEMP%\nsxa92.tmp\ocsplugins\services.vbs
%TEMP%\nsxa92.tmp\ocsplugins\security.vbs
%TEMP%\nsxa92.tmp\ocsplugins\runningprocess.vbs
%TEMP%\nsxa92.tmp\ocsplugins\networkshare.vbs
%TEMP%\nsxa92.tmp\ocsdata\cacert.pem
%TEMP%\nsxa92.tmp\ocsdat.ini
%TEMP%\nsxa92.tmp\ocs-ng-windows-agent-setup.log
%TEMP%\nsxa92.tmp\instocs.exe
%TEMP%\nsxa92.tmp\system.dll
%TEMP%\nsje2c.tmp\system.dll
%TEMP%\nsq137c.tmp\system.dll
%TEMP%\nsq137c.tmp\splash.bmp
%TEMP%\nsq137c.tmp\setacl.exe
%TEMP%\nsq137c.tmp\services.dll
%TEMP%\nsq137c.tmp\server.ini
%TEMP%\nsq137c.tmp\proxy.ini
%TEMP%\nsq137c.tmp\nsexec.dll
%TEMP%\nsq137c.tmp\local.ini
%TEMP%\nsq137c.tmp\killprocdll.dll
%TEMP%\nsq137c.tmp\agent.ini
%TEMP%\nsq137c.tmp\advsplash.dll
%PROGRAMDATA%\ocs inventory ng\agent\rand
%TEMP%\nsq137c.tmp\userinfo.dll
%TEMP%\nsxa92.tmp\userinfo.dll

Substitutes the following files

%PROGRAMDATA%\ocs inventory ng\agent\ocsinventory.log
%PROGRAMDATA%\ocs inventory ng\agent\rand

Network activity

UDP

DNS ASK as###.pc-web.at

Miscellaneous

Creates and executes the following

'%TEMP%\nsxa92.tmp\instocs.exe'
'%TEMP%\nsxa92.tmp\ocssetup.exe' /server=https://asset.pc-web.at/ocsinventory /S
'%ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe' /SAVE_CONF /SERVER=https://asset.pc-web.at/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG=""
'%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe' -install
'%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe'
'%ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe'
'%ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe' /SAVE_CONF /SERVER=https://asset.pc-web.at/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG=""' (with hidden window)
'%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe' -install' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles(x86)%\OCS Inventory Agent\ocsinventory.exe"' (with hidden window)

Executes the following