Trojan.Win32.INFOSTEAL.AA.tmsr

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops and executes the following files:

• %Temp%\ttt.exe -> modified copy of itself. Detected as Trojan.Win32.INFOSTEAL.AA.tmsr
• %System%\wmiex.exe -> modified copy of itself. Detected as Trojan.Win32.INFOSTEAL.AA.tmsr
• %System%\drivers\taskmgr.exe -> detected as Coinminer.Win32.MALXMR.ADS

It drops the following copies of itself into the affected system:

• %System%\drivers\svchost.exe
• %System%\svhost.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• netsh firewall add portopening tcp 65532 UDP
• netsh firewall add portopening tcp 65531 UDP2
• netsh firewall add portopening tcp 65533 ShareService
• netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53
• netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• AHDPQOE987aaapb7
• it is holy shit

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Ddriver = %System%\drivers\svchost.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WebServers = %System%\wmiex.exe

It adds and runs the following services:

• Ddriver:
  • Description: Provides abilitiy to share TCP ports over the net.tcp protocol {Date of Installation}
  • Path: %System%\drivers\svchost.exe
• WebServers:
  • Description: forwards it to Provide HTTP Servers.
  • Path: %System%\wmiex.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\WebServers
ImagePath = %System%\wmiex.exe

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\WebServers
DisplayName = WebServers

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Ddriver
DisplayName = Ddriver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Ddriver
ImagePath = %System%\drivers\svchost.exe

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\PortProxy\v4tov4\
tcp
*/65532 = 1.1.1.1/53

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\PortProxy\v4tov4\
tcp
*/65531 = 1.1.1.1/53

Download Routine

This Trojan accesses the following websites to download files:

• http://ii.{BLOCKED}.net/u.png?{Stolen Info}
• http://p.{BLOCKED}.com/im.png?{Stolen Info}
• http://i.{BLOCKED}.net/i.png?{Stolen Info}
• http://o.{BLOCKED}.com/i.png?{Stolen Info}
• http://{BLOCKED}.{BLOCKED}.107.97/h.bat?{Stolen Info}
• http://{BLOCKED}.{BLOCKED}.107.97/xmrig-32_1.mlz?{Stolen Info}
• http://dl.{BLOCKED}.net/ins2.exez?{Stolen Info}

It saves the files it downloads using the following names:

• %Temp%\h.bat -> cointains flushdns command
• %Temp%\svchost.exe -> Trojan.WIn32.MIMIKATZ.ADU
• %Temp%\svchost.mlz -> encrypted file read by taskmgr.exe for its coinminingroutine

Information Theft

This Trojan gathers the following data:

• Computer Name
• GUID
• MAC Address
• User Name
• Version
• Operating System
• AV Products
• OS Architecture = 32/64 bit
• CPU
• Video Card

Other Details

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Ddriver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\WebServers

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\PortProxy\v4tov4

It does the following:

• Terminates all running old version of the malware
• For 64 bit systems, the value of %System% is equivalent to C:\Windows\SysWOW64
• Enable port forwarding and enables windows firewall
• Connects to the following URL to send system information:
  • http://ii.{BLOCKED}.net/u.png?{Stolen Info}
  • http://p.{BLOCKED}.com/im.png?{Stolen Info}
  • http://i.{BLOCKED}.net/i.png?{Stolen Info}
  • http://o.{BLOCKED}.com/i.png?{Stolen Info}
  • http://{BLOCKED}.{BLOCKED}.107.97/h.bat?{Stolen Info}
  • http://{BLOCKED}.{BLOCKED}.107.97/xmrig-32_1.mlz?{Stolen Info}
  • http://dl.{BLOCKED}.net/ins2.exez?{Stolen Info}

It adds the following scheduled tasks:

• Task Name: Ddrivers
  • Task Action: cmd /c %System%\drivers\svchost.exe
• Task Name: WebServers
  • Task Action: cmd /c %System%\wmiex.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)