Trojan.Win64.HELPERDRIVER.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %User Temp%\pE6KNzQ.sys ← copy of {Malware Path}\pE6KNzQ.sys

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• DbServer.exe
• CNTAoSMgr.exe
• iCRCService.exe
• LogServer.exe
• LWCSService.exe
• Ntrtscan.exe
• OfcDdaSvr.exe
• OfcService.exe
• PccNt.exe
• PccNTMon.exe
• tmwscsvc.exe
• SupportConnector.exe
• TmCCSF.exe
• tmssclient.exe
• TmListen.exe
• TmsaInstance64.exe
• SoftMon.exe
• IvAppMonSvc.exe
• svcGenericHost.exe
• TMBMSRV.exe
• dsa.exe
• ds_monitor.exe
• ds_nuagent.exe
• Notifier.exe
• PtSessionAgent.exe
• uiSeAgnt.exe
• uiWatchDog.exe
• coreFrameworkHost.exe
• AMSPTelemetryService.exe
• coreServiceShell.exe
• DrSDKCaller.exe
• PtSvcHost.exe
• PtWatchDog.exe
• mpcmdrun.exe
• msmpeng.exe
• NisSrv.exe
• MpCopyAccelerator.exe

Andere Details

Es macht Folgendes:

• It creates and starts a service named "pE6KNzQ" with the following details:
  • Name: pE6KNzQ
  • Display Name: pE6KNzQ
  • Type: Driver
  • Start Type: System start
  • Binary Path: %User Temp%\pE6KNzQ.sys
• It checks if the service "pE6KNzQ" has been successfully executed:
  • If the service is running:
    • It terminates Trend Micro related applications that are found to be running in the affected system.
  • If execution failed:
  • It displays a message box saying "Failed to connect to kernel driver", then terminates itself.
    
    
• It requires the existence of the following file to be able to proceed to its malicious behavior:
  • {Malware Path}\pE6KNzQ.sys