Trojan.Siggen10.30596

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '%WINDIR%\taskmgr.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = '%WINDIR%\rstrui.exe'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe"'

Creates the following services

'RManService' "%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe"
'RManService' %ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system

Creates the following files

%TEMP%\rarsfx0\msi.msi
%ProgramFiles(x86)%\remote utilities - host\printer\x64\fwproc_x64.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup_s.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\uninstall.cmd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui2.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\progress.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rup.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ruppm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\vpdagent.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\srvinst.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\install.cmd
%ProgramFiles(x86)%\remote utilities - host\japanese.lg
%ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
%WINDIR%\installer\{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
%WINDIR%\installer\{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
%WINDIR%\installer\{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
%WINDIR%\installer\{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
%WINDIR%\installer\{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\arpproducticon.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup_s.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\uninstall.cmd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\install.cmd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rup.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ruppm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\vpdagent_x64.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui2.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x86\progress.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\fwproc.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.ini
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\drvinstaller64.exe
%ProgramFiles(x86)%\remote utilities - host\spanish.lg
%ProgramFiles(x86)%\remote utilities - host\eula.rtf
%ProgramFiles(x86)%\remote utilities - host\ripcserver.dll
%ProgramFiles(x86)%\remote utilities - host\rwln.dll
%ProgramFiles(x86)%\remote utilities - host\english.lg
%ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
%ProgramFiles(x86)%\remote utilities - host\rutserv.exe
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.cat
%ProgramFiles(x86)%\remote utilities - host\turkish.lg
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.inf
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.sys
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\drvinstaller32.exe
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.cat
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.inf
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.sys
%TEMP%\rarsfx0\one.vbs
%TEMP%\rarsfx0\one.cmd
%ALLUSERSPROFILE%\remote utilities\msi\69014_{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\msi.msi
%ProgramFiles(x86)%\remote utilities - host\printer\x64\srvinst_x64.exe
%ProgramFiles(x86)%\remote utilities - host\polish.lg
%ProgramFiles(x86)%\remote utilities - host\german.lg
%ProgramFiles(x86)%\remote utilities - host\hebrew.lg
%ProgramFiles(x86)%\remote utilities - host\ssleay32.dll
%ProgramFiles(x86)%\remote utilities - host\libeay32.dll
%ProgramFiles(x86)%\remote utilities - host\portuguese.lg
%ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmmux.dll
%ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
%ProgramFiles(x86)%\remote utilities - host\chinese simplified.lg
%ProgramFiles(x86)%\remote utilities - host\danish.lg
%ProgramFiles(x86)%\remote utilities - host\swedish.lg
%ProgramFiles(x86)%\remote utilities - host\norwegian.lg
%ProgramFiles(x86)%\remote utilities - host\korean.lg
%ProgramFiles(x86)%\remote utilities - host\italian.lg
%ProgramFiles(x86)%\remote utilities - host\dutch.lg
%ProgramFiles(x86)%\remote utilities - host\czech.lg
%ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
%ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
%ProgramFiles(x86)%\remote utilities - host\arabic.lg
%ProgramFiles(x86)%\remote utilities - host\french.lg
%ProgramFiles(x86)%\remote utilities - host\logs\rut_log_2020-09.html

Deletes the following files

%ALLUSERSPROFILE%\remote utilities\msi\69014_{1e4ab2fc-b243-45c2-bf6a-a027213183cd}\msi.msi
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\oisicon.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\outicon.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\pptico.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\pubs.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\shellui.mst
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\wordicon.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\xlicons.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\misc.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\msouc.exe
%WINDIR%\installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\MSDN_Icon
%ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
%ProgramFiles(x86)%\remote utilities - host\czech.lg
%ProgramFiles(x86)%\remote utilities - host\danish.lg
%ProgramFiles(x86)%\remote utilities - host\dutch.lg
%ProgramFiles(x86)%\remote utilities - host\english.lg
%ProgramFiles(x86)%\remote utilities - host\eula.rtf
%ProgramFiles(x86)%\remote utilities - host\french.lg
%WINDIR%\installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\ndpsetup.ico
%ProgramFiles(x86)%\remote utilities - host\arabic.lg
%ProgramFiles(x86)%\remote utilities - host\hebrew.lg
%ProgramFiles(x86)%\remote utilities - host\german.lg
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\grvicons.exe
%WINDIR%\installer\6fcf49.msp
%WINDIR%\installer\6fcf87.msp
%WINDIR%\installer\6fcf9c.msp
%WINDIR%\installer\6fcfaf.msp
%WINDIR%\installer\6fcfb6.msp
%WINDIR%\installer\6fcfd0.msp
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\inficon.exe
%WINDIR%\installer\6fcdbc.msi
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\joticon.exe
%WINDIR%\installer\6fcfd9.msp
%WINDIR%\installer\ce992.msi
%WINDIR%\installer\ce993.msp
%WINDIR%\installer\d1584.msi
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\accicons.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\cagicon.exe
%WINDIR%\installer\{90140000-0011-0000-1000-0000000FF1CE}\graph.ico
%WINDIR%\installer\6fcfee.msp
%WINDIR%\installer\8d0a7.msi
%WINDIR%\installer\cd5ac.msi
%WINDIR%\installer\1ae04.msi
%ProgramFiles(x86)%\remote utilities - host\italian.lg
%ProgramFiles(x86)%\remote utilities - host\printer\x86\install.cmd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\progress.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ruppm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\fwproc.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui2.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\vpdagent.exe
%ProgramFiles(x86)%\remote utilities - host\rutserv.exe
%ProgramFiles(x86)%\remote utilities - host\rwln.dll
%ProgramFiles(x86)%\remote utilities - host\spanish.lg
%ProgramFiles(x86)%\remote utilities - host\ssleay32.dll
%ProgramFiles(x86)%\remote utilities - host\swedish.lg
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rup_s.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x86\srvinst.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup_s.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui2.exe
%ProgramFiles(x86)%\remote utilities - host\korean.lg
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.cat
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.inf
%ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.sys
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.cat
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.inf
%ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.sys
%ProgramFiles(x86)%\remote utilities - host\norwegian.lg
%ProgramFiles(x86)%\remote utilities - host\polish.lg
%ProgramFiles(x86)%\remote utilities - host\libeay32.dll
%ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x64\progress.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ruppm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui.dll
%WINDIR%\installer\6fcdb3.msi
%ProgramFiles(x86)%\remote utilities - host\printer\x64\install.cmd
%WINDIR%\installer\6fcf3d.msp
%WINDIR%\installer\6fcdac.msi
%WINDIR%\installer\6fcda6.msi
%WINDIR%\installer\6fcda0.msi
%WINDIR%\installer\1ad48.msi
%WINDIR%\installer\1ad4e.msi
%WINDIR%\installer\1ad54.msi
%WINDIR%\installer\1ad5b.msi
%WINDIR%\installer\1ad7a.msi
%WINDIR%\installer\1ad80.msi
%WINDIR%\installer\1ad36.msi
%WINDIR%\installer\1ad2a.msi
%WINDIR%\installer\1ad42.msi
%WINDIR%\installer\1ada2.msi
%WINDIR%\installer\1adba.msi
%WINDIR%\installer\1adc0.msi
%WINDIR%\installer\1addf.msi
%WINDIR%\installer\1ade5.msi
%WINDIR%\installer\1adeb.msi
%WINDIR%\installer\1adf1.msi
%WINDIR%\installer\1ada8.msi
%WINDIR%\installer\1adae.msi
%WINDIR%\installer\1adb4.msi
%WINDIR%\installer\1ad30.msi
%WINDIR%\installer\1ad24.msi
%WINDIR%\installer\1adf7.msi
%WINDIR%\installer\13088.msi
%WINDIR%\installer\13736.msi
%WINDIR%\installer\13740.msi
%WINDIR%\installer\1376e.msi
%WINDIR%\installer\1377d.msi
%WINDIR%\installer\137ba.msi
%WINDIR%\installer\137bf.msi
%WINDIR%\installer\137c4.msi
%WINDIR%\installer\10ecf2.msi
%WINDIR%\installer\137c9.msi
%WINDIR%\installer\13dd2d.msi
%WINDIR%\installer\13dd32.msi
%WINDIR%\installer\1acd4.msi
%WINDIR%\installer\1acda.msi
%WINDIR%\installer\1ace0.msi
%WINDIR%\installer\1ace6.msi
%WINDIR%\installer\1acec.msi
%WINDIR%\installer\1acf3.msi
%WINDIR%\installer\13dd28.msi
%ProgramFiles(x86)%\remote utilities - host\turkish.lg
%ProgramFiles(x86)%\remote utilities - host\japanese.lg
%WINDIR%\installer\1adfe.msi
%WINDIR%\installer\1ae16.msi
%WINDIR%\installer\5eafb.msi
%WINDIR%\installer\602e8.msi
%WINDIR%\installer\6fcd4b.msi
%WINDIR%\installer\6fcd51.msi
%WINDIR%\installer\6fcd57.msi
%WINDIR%\installer\6fcd5d.msi
%WINDIR%\installer\5eae9.msi
%WINDIR%\installer\6fcd63.msi
%WINDIR%\installer\5eaf5.msi
%WINDIR%\installer\6fcd6f.msi
%WINDIR%\installer\6fcd7b.msi
%WINDIR%\installer\6fcd81.msi
%WINDIR%\installer\6fcd87.msi
%WINDIR%\installer\6fcd8d.msi
%WINDIR%\installer\6fcd94.msi
%WINDIR%\installer\6fcd9a.msi
%WINDIR%\installer\6fcd69.msi
%WINDIR%\installer\1ad3c.msi
%WINDIR%\installer\6fcd75.msi
%WINDIR%\installer\5eaef.msi
%WINDIR%\installer\299fe1.msp
%WINDIR%\installer\299f16.msi
%WINDIR%\installer\1ae1c.msi
%WINDIR%\installer\1ae22.msi
%WINDIR%\installer\1ae28.msi
%WINDIR%\installer\1ae2e.msi
%WINDIR%\installer\1ae34.msi
%WINDIR%\installer\1ae3b.msi
%WINDIR%\installer\1ae41.msi
%WINDIR%\installer\1ae10.msi
%WINDIR%\installer\1ae47.msi
%WINDIR%\installer\1ae53.msi
%WINDIR%\installer\1ae59.msi
%WINDIR%\installer\1ae5f.msi
%WINDIR%\installer\1ae65.msi
%WINDIR%\installer\1ae6b.msi
%WINDIR%\installer\1ae71.msi
%WINDIR%\installer\1ae77.msi
%WINDIR%\installer\1ae7d.msi
%WINDIR%\installer\1ae4d.msi
%WINDIR%\installer\1ae83.msi
%WINDIR%\installer\1ae0a.msi
%ProgramFiles(x86)%\remote utilities - host\webmmux.dll

Network activity

TCP

HTTP GET requests

http://ad##.#scertia.com/cert/AscertiaPublicCA1.cer
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'13.##2.227.167':5655

UDP

DNS ASK ad##.#scertia.com
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\RarSFX0\msi.msi"
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /firewall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe'
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\one.vbs"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\one.cmd" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i msi.msi /qn
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\one.cmd" "
'%WINDIR%\syswow64\reg.exe' delete HKEY_CLASSES_ROOT\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t Reg_sz /d "%WINDIR%\taskmgr.exe" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe" /v Debugger /t Reg_sz /d "%WINDIR%\rstrui.exe" /f
'<SYSTEM32>\vssvc.exe'
'%WINDIR%\syswow64\sc.exe' config RManService displayname= "Windows Software Update"
'%WINDIR%\syswow64\sc.exe' Description RManService "Microsoft Windows Software Update"
'%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Remote Utilities - Host"
'%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles(x86)%\Remote Utilities - Host"
'%WINDIR%\syswow64\icacls.exe' "%ProgramFiles%\Remote Utilities - Host" /setowner "NT Service\TrustedInstaller"
'%WINDIR%\syswow64\icacls.exe' "%ProgramFiles%\Remote Utilities - Host" /grant:r System:(RX,W) /inheritance:r
'%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\Remote Utilities - Host" /setowner "NT Service\TrustedInstaller"
'%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\Remote Utilities - Host" /grant:r System:(RX,W) /inheritance:r

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней