Trojan.Win64.HELPERDRIVER.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\pE6KNzQ.sys ← copy of {Malware Path}\pE6KNzQ.sys

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• DbServer.exe
• CNTAoSMgr.exe
• iCRCService.exe
• LogServer.exe
• LWCSService.exe
• Ntrtscan.exe
• OfcDdaSvr.exe
• OfcService.exe
• PccNt.exe
• PccNTMon.exe
• tmwscsvc.exe
• SupportConnector.exe
• TmCCSF.exe
• tmssclient.exe
• TmListen.exe
• TmsaInstance64.exe
• SoftMon.exe
• IvAppMonSvc.exe
• svcGenericHost.exe
• TMBMSRV.exe
• dsa.exe
• ds_monitor.exe
• ds_nuagent.exe
• Notifier.exe
• PtSessionAgent.exe
• uiSeAgnt.exe
• uiWatchDog.exe
• coreFrameworkHost.exe
• AMSPTelemetryService.exe
• coreServiceShell.exe
• DrSDKCaller.exe
• PtSvcHost.exe
• PtWatchDog.exe
• mpcmdrun.exe
• msmpeng.exe
• NisSrv.exe
• MpCopyAccelerator.exe

Otros detalles

Hace lo siguiente:

• It creates and starts a service named "pE6KNzQ" with the following details:
  • Name: pE6KNzQ
  • Display Name: pE6KNzQ
  • Type: Driver
  • Start Type: System start
  • Binary Path: %User Temp%\pE6KNzQ.sys
• It checks if the service "pE6KNzQ" has been successfully executed:
  • If the service is running:
    • It terminates Trend Micro related applications that are found to be running in the affected system.
  • If execution failed:
  • It displays a message box saying "Failed to connect to kernel driver", then terminates itself.
    
    
• It requires the existence of the following file to be able to proceed to its malicious behavior:
  • {Malware Path}\pE6KNzQ.sys