Trojan.PS1.LEMONDUCK.THDBHBA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals certain information from the system and/or the user.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\WindowsPowerShell\v1.0\{Random string}.exe -> copy of powershell.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• Set-MpPreference -DisableRealtimeMonitoring 1
• Add-MpPreference -ExclusionPath c:\
• Add-MpPreference -ExclusionProcess %System%\WindowsPowerShell\v1.0\powershell.exe
• Add-MpPreference -ExclusionProcess %System%\WindowsPowerShell\v1.0\{random string}.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\eLocalIf
• Global\eLocalKr

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Office\12.0\Outlook\
Security
ObjectModelGuard = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Office\8.0\Outlook\
Security
ObjectModelGuard = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Office\{Office version}\
Outlook\Security
ObjectModelGuard = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Office\ClickToRun\REGISTRY\
MACHINE\Software\Microsoft\
Office\{Office version}\Outlook\
Security
ObjectModelGuard = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Office\ClickToRun\REGISTRY\
MACHINE\Software\Wow6432Node\
Microsoft\Office\{Office version}\
Outlook\Security
ObjectModelGuard = 2

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://d.{BLOCKED}n.com/kr.bin?&{Computer Name}&{GUID}&{Mac address}
• http://d.{BLOCKED}n.com/if.bin?{Computer Name}&{GUID}&{Mac address}
• http://d.{BLOCKED}n.com/m6.bin?{Computer Name}&{GUID}&{Mac address} - if running in 64-bit
• http://d.{BLOCKED}n.com/m6g.bin?{Computer Name}&{GUID}&{Mac address} - if running in 64-bit and has Nvidia or AMD graphics card
• http://d.{BLOCKED}n.com/nvd.zip -> if running on 64-bit, has Nvidia graphics card, and %User Temp%\nvdg.dat does not exist on the machine

It saves the files it downloads using the following names:

• %User Temp%\if.bin
• %User Temp%\kr.bin
• %User Temp%\m6.bin -> if running in 64-bit
• %User Temp%\m6g.bin -> if running in 64-bit and has Nvidia or AMD graphics card
• %User Temp%\nvd.zip -> if running on 64-bit and has Nvidia graphics card and %User Temp%\nvdg.dat does not exist on the machine

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Trojan steals the following information:

• Computer System Product UUID
• MAC Address
• Operating System
• Username
• Computer Domain Name
• System Uptime
• Graphics Card Name
• Graphics Card Memory
• Network, Removable, and Fixed Drives
• System Architecture (x64 or x86)

Other Details

This Trojan does the following:

• Loads javascript stored in the following local address:
  • http://{BLOCKED}.0.0.1:43669/1/summary
• Downloads and executes powershell from the following addresses:
  • http://t{BLOCKED}n.com/report.jsp?&{Computer name}&{GUID}&{Mac address}&{Operating System}&{is 64bit}&{User Name}&{Domain}&{Available drives}&{Video Card Name}&{video card memory in GB}&{is admin}&{if.bin hash}&{m6.bin hash}&{kr.bin md5 hash}&{version of javascript loaded from local }&{IP of javascript loaded from local}&{hashrate of javascript loaded from local}&{system uptime}&{timestamp}&0.4