Packer: WinLicense
Dates of compilation and SHA1 hashes:
- 8165872f1dbbb04a2eedf7818e16d8e40c17ce5e (WinDHCP.dll, x64) - 19.05.2017 01:26:24
- 027340983694446b0312abcac72585470bf362da (WinDHCP.dll, x86) - 19.05.2017 01:26:31
Description
Trojan.Belonard.7 is part of the Belonard trojan. The original names are srv32.dll (x86) and srv.dll (x64). Trojan.Belonard.7 is a malicious library called WinDHCP.dll with one exported function “ServiceMain”. Trojan.Belonard.7 is WinDHCP.dll with a ServiceMain exported function, installed on an infected device by an autorun service. Trojan.Belonard.6 is created by Mssv16.asi (Trojan.Belonard.3). Runs davapi.dll (Trojan.Belonard.6) and spwinres.dll (Trojan.Belonard.4).
Operating routine
The trojan checks the “Tag” parameter in the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinDHCP. If it is set to 0, Trojan.Belonard.7 loads the davapi.dll library and calls its exported function “x”, passing a pointer to a SERVICE_STATUS as an argument, which reflects the status of the WinDHCP service. It then waits for 1 second and checks the “Tag” parameter once more. If it’s different from 0, it calls spwinres.dll’s exported function, passing a pointer to the SERVICE_STATUS as an argument, which reflects the status of the WinDHCP service.
The trojan repeats these actions every second.
The WinDHCP service parameters from our customer’s report:
<RegistryKey Name="WinDHCP" Subkeys="1" Values="11">
<RegistryKey Name="Parameters" Subkeys="0" Values="1">
<RegistryValue Name="ServiceDll" Type="REG_EXPAND_SZ" SizeInBytes="68" Value="%SystemRoot%\system32\WinDHCP.dll" />
</RegistryKey>
<RegistryValue Name="Type" Type="REG_DWORD" Value="32" />
<RegistryValue Name="Start" Type="REG_DWORD" Value="2" />
<RegistryValue Name="ErrorControl" Type="REG_DWORD" Value="0" />
<RegistryValue Name="ImagePath" Type="REG_EXPAND_SZ" SizeInBytes="90" Value="%SystemRoot%\System32\svchost.exe -k netsvcs" />
<RegistryValue Name="DisplayName" Type="REG_SZ" Value="Служба Windows DHCP" />
<RegistryValue Name="ObjectName" Type="REG_SZ" Value="LocalSystem" />
<RegistryValue Name="Description" Type="REG_SZ" Value="Служба протокола динамической настройки узла Windows" />
<RegistryValue Name="Tag" Type="REG_DWORD" Value="0" />
<RegistryValue Name="Data" Type="REG_BINARY" SizeInBytes="32" Value="f0dd5c3aeda155767042fa9f58ade24681af5fbd45d5df9f55a759bd65bc0b7e" />
<RegistryValue Name="Scheme" Type="REG_BINARY" SizeInBytes="16" Value="dcef62f71f8564291226d1628278239e" />
<RegistryValue Name="Info" Type="REG_BINARY" SizeInBytes="32" Value="55926164986c6020c60ad81b887c616db85f191fda743d470f392bb45975dfeb" />
</RegistryKey>
The tag, data, scheme and info parameters are filled by davapi.dll.
