Trojan.DownLoader45.38031

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-501qr.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-dm3sk.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-rln23.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-n95cr.tmp
%ProgramFiles(x86)%\reg organizer\is-f2dse.tmp
%ProgramFiles(x86)%\reg organizer\is-kachj.tmp
%ProgramFiles(x86)%\reg organizer\is-4oqms.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-1f2lj.tmp
%ProgramFiles(x86)%\reg organizer\is-sr8pv.tmp
%ProgramFiles(x86)%\reg organizer\is-qtndn.tmp
%ProgramFiles(x86)%\reg organizer\is-lg33g.tmp
%ProgramFiles(x86)%\reg organizer\is-br5j4.tmp
%ProgramFiles(x86)%\reg organizer\is-odeog.tmp
%ProgramFiles(x86)%\reg organizer\is-qnod7.tmp
%ProgramFiles(x86)%\reg organizer\is-m8c77.tmp
%ProgramFiles(x86)%\reg organizer\is-hd5bl.tmp
%ProgramFiles(x86)%\reg organizer\is-8n2p6.tmp
%ProgramFiles(x86)%\reg organizer\is-7megb.tmp
%ProgramFiles(x86)%\reg organizer\is-rrql7.tmp
%ProgramFiles(x86)%\reg organizer\is-0d19f.tmp
%ProgramFiles(x86)%\reg organizer\is-dq9hb.tmp
%ProgramFiles(x86)%\reg organizer\is-gu5rc.tmp
%ProgramFiles(x86)%\reg organizer\is-2elkr.tmp
%ProgramFiles(x86)%\reg organizer\is-8tiqp.tmp
%TEMP%\is-1qja7.tmp\_isetup\_iscrypt.dll
%TEMP%\is-1qja7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1qja7.tmp\_isetup\_setup64.tmp
%TEMP%\is-1qja7.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-8tiqp.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-n95cr.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-f2dse.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-kachj.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-4oqms.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-1f2lj.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-sr8pv.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-qtndn.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-lg33g.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-br5j4.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-rln23.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-odeog.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-m8c77.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-hd5bl.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-8n2p6.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-7megb.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-rrql7.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-0d19f.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-dq9hb.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-gu5rc.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-2elkr.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-qnod7.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-dm3sk.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{1ca8f2c86a6335d440915ba1d7aa3752}' WindowName: ''

Creates and executes the following

'%TEMP%\is-501qr.tmp\<File name>.tmp' /SL5="$B0218,5377019,319488,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' 42f4a101d7c26c2a9e2e3b6d1e2f5726

Executes the following