TROJ_REGIN.A

 Analysis by: Cris Nowell Pantanilla

 PLATFORM:

Windows, Windows 64-bit

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

REGIN is a sophisticated malware that has been used to target high profile victims. REGIN uses a variety of advanced evasion techniques. such as the use of multiple infection chains and modules, to avoid detection in order to steal information.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

SYS, DLL

Memory Resident:

Yes

Initial Samples Received Date:

24 Nov 2014

Payload:

Compromises system security, Steals information

NOTES:

This is the Trend Micro detection for malicious files that belong to malware group Regin. This is a multi-component malware that uses different files for its functionalities and payload.

Installation

The initial load file is responsible for initializing the routines. This file is usually found in the "System32" folder and may use any of the following filenames:

  • abiosdsk.sys
  • adpu160.sys
  • atdisk.sys
  • cdaudio.sys
  • floppy.sys
  • ndisips.sys
  • parclass.sys
  • pciclass.sys
  • pcidump.sys
  • pciport.sys
  • rasprt.sys
  • rdpmdd.sys
  • Ser8UART.sys
  • serial.sys
  • usbclass.sys

This malware does not store files using the usual file system for its installation. Rather, it stores components in the NTFS Extended Attributes or a registry blob:

  • Extended Attrbibutes:
    • %Windows%
    • %Windows%\fonts
    • %Windows%\cursors
    • %Windows%\system32
    • %Windows%\system32\drivers

    (Notes: %Windows% is the Windows folder, which is usually C:\Window.)

  • Registry Subkey:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{39399744-44FC-AD65-474B-E4DDF-8C7FB97}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{3F90B1B4-58E2-251E-6FFE-4D38C5631A04}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA58}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA5A}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{9B9A8ADB-8864-4BC4-8AD5-B17DFDBB9F58}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList\VideoBase

It creates the following files as markers to identify infected machines:

  • %System%\nsreg1.dat
  • %System%\bssec3.dat
  • %System%\msrdc64.dat

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Payload

This malware stores its payloads in encrypted file storage known as Virtual File Systems (VFS). The payload may be stored in the following files/directories:

  • %System%\config\SystemAudit.Evt
  • %System%\config\SecurityAudit.Evt
  • %System%\config\SystemLog.evt
  • %System%\config\ApplicationLog.evt
  • %Windows%\ime\imesc5\dicts\pintlgbs.imd
  • %Windows%\ime\imesc5\dicts\pintlgbp.imd

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions. %Windows% is the Windows folder, which is usually C:\Window.)

Functionalities and Information Stealing

This malware group have the following capabilities:

  • Rootkit
  • Network Port Blocker
  • Network Capture
  • Credential Stealing
  • C&C Communication
  • Cryptography Functions
  • Gather System Information
  • UI manipulation (Screenshot,Log Keystrokes,Click Functionalities)
  • File System Manipulation (Create/Read/Write/Delete)
  • Process and Module Manipulation
  • IIS Web Server Log Theft
  • GSM Activity Log

It connects to the following Command & Control (C&C) servers to send and received information:

  • {BLOCKED}.{BLOCKED}.114.73
  • {BLOCKED}.{BLOCKED}.144.113
  • {BLOCKED}.{BLOCKED}.89.80
  • {BLOCKED}.{BLOCKED}.237.145

  SOLUTION

Minimum Scan Engine:

9.700

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to clean files detected as TROJ_REGIN.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.