Analysis by: Johnlery Triunfante
ALIASES:

Trojan:Win32/Dynamer!rfn (Microsoft); Mal/Elenoocka-E (Sophos)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel: Dropped by other malware

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes registry keys related to antivirus programs. Doing this allows this malware to execute its routines without being detected by installed antivirus programs.

It executes commands from a remote malicious user, effectively compromising the affected system.

  TECHNICAL DETAILS

File Size: 168,960 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 05 Mar 2018
Payload: Drops files, Executes files

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system and executes them:

  • %User Temp%\{8 Random Character}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It drops the following files:

  • %AppDataLocal%\{8 Random Character}.log
  • %AppDataLocal%\{Random Folder Name}\{Random Characters}.tm
  • %ProgramData%\{8 Random Character}.log

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData in Windows Vista, 7, and 8.)

It drops and executes the following files:

  • %AppDataLocalLow%\cmd.{User name}.bat → Deleted afterwards
  • %AppDataLocalLow%\com.{User name}.sdb → Deleted afterwards

(Note: %AppDataLocalLow% is the LocalLow Application Data folder, which is usually C:\Users\{user name}\AppData\LocalLow on Windows Vista, 7, and 8.)

It drops the following copies of itself into the affected system:

  • %User Startup%\{8 Random Character}.exe
  • %AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • {GUID}

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{8 Random Character} = %AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = {Default value for Userinit},%AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
svchost.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
consent.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
rundll32.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
spoolsv.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
explorer.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
rgjdu.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
afwqs.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Extensions
*.tmp = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Extensions
*.dll = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Extensions
*.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
svchost.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
consent.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
rundll32.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
spoolsv.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
explorer.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
rgjdu.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
afwqs.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Extensions
*.tmp = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Extensions
*.dll = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Extensions
*.exe = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
jfghdug_ooetvtgk = TRUE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\wscsvc
Start = 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\MpsSvc
Start = 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\wscsvc
Start = 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\WinDefend
Start = 4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\wuauserv
Start = 4

It deletes the following registry keys related to antivirus and security applications:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = {Windows Defender path}

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

  • kos → Remove HKEY_LOCAL_MACHINE\SOFTWARE, HKEY_LOCAL_MACHINE\SYSTEM, HKEY_LOCAL_MACHINE\HARDWARE, and HKEY_CURRENT_USER\SOFTWARE, and then force the system to shutdown
  • screen → Take and upload a screenshot
  • update → Update itself
  • getexec → Download and execute a file
  • cookies → Send a created log file that contains cookies and upload to a remote location
  • removecookies - Deletes cookies

It connects to the following URL(s) to send and receive commands from a remote malicious user:

  • It uses domain generation algorithm (DGA) for its C&C servers. Where the domain could be one of the following:
    • {BLOCKED}hsussiiwuwyw.com
    • {BLOCKED}ueaneumqx.com
    • {BLOCKED}qoyjjpb.com
    • {BLOCKED}jpvdbxsjos.com
    • {BLOCKED}rgujyymhvvg.com

Other Details

This Backdoor connects to the following URL(s) to check for an Internet connection:

  • google.com:80
  • bing.com:80
  • yahoo.com:80

It does the following:

  • It uses the following vulnerability to escalate its privilege:
  • It executes the following command:
    • "%System%\sdbinst.exe" /q "%User Temp%\..\..\LocalLow\com.{User name}.sdb"
    • cmd /c %User Temp%\..\..\LocalLow\cmd.{User name}.bat
  • It attempts to hide itself from Windows defender by executing the following commands:
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v svchost.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v consent.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v rundll32.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v spoolsv.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v explorer.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v rgjdu.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes \" /v afwqs.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions \" /v *.tmp /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions \" /v *.dll /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions \" /v *.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v svchost.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v consent.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v rundll32.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v spoolsv.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v explorer.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v rgjdu.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes \" /v afwqs.exe /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions \" /v *.tmp /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions \" /v *.dll /t REG_DWORD /d 0
    • REG ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions \" /v *.exe /t REG_DWORD /d 0
  • It steals cookies from the following application:
    • Internet Explorer
    • Firefox
    • Opera
    • Flash
    • Safari
    • Chrome
  • It creates a named pipe.
    • \.\pipe\{8 random character}
  • It executes and injects its DLL component into the following processes:
    • svchost.exe
    • explorer.exe
    • spoolsv.exe

  SOLUTION

Minimum Scan Engine: 9.850
FIRST VSAPI PATTERN FILE: 14.116.04
FIRST VSAPI PATTERN DATE: 08 Mar 2018
VSAPI OPR PATTERN File: 14.117.00
VSAPI OPR PATTERN Date: 09 Mar 2018

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • {8 Random Character} = %AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • svchost.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • consent.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • rundll32.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • spoolsv.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • explorer.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • rgjdu.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes
    • afwqs.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions
    • *.tmp = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions
    • *.dll = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions
    • *.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • svchost.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • consent.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • rundll32.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • spoolsv.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • explorer.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • rgjdu.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes
    • afwqs.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions
    • *.tmp = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions
    • *.dll = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions
    • *.exe = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
    • jfghdug_ooetvtgk = TRUE
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    • EnableLUA = 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UacDisableNotify = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusOverride = 1
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • EnableFirewall = 0
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DoNotAllowExceptions = 0
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DisableNotifications = 1

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • From: Userinit = {Default value for Userinit},%AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe
      To: Userinit = {Default value for Userinit}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\services\wscsvc
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv
    • From: Start = 4
      To: Start = 2

Step 6

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.  
  • %User Temp%\{8 Random Character}.exe
  • %AppDataLocal%\{8 Random Character}.log
  • %AppDataLocal%\{Random Folder Name}\{Random Characters}.tm
  • %ProgramData%\{8 Random Character}.log
  • %User Startup%\{8 Random Character}.exe
  • %AppDataLocal%\{Random Folder Name}\{8 Random Character}.exe

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_RAMNIT.JT. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 8

Download and apply these security patches Refrain from using these products until the appropriate patches have been installed. Trend Micro advises users to download critical patches upon release by vendors.


Did this description help? Tell us how we did.