Trojan.Siggen12.63644

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}

Malicious functions

Executes the following

'%WINDIR%\syswow64\at.exe'

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe

Modifies file system

Creates the following files

%TEMP%\4dd3.tmp
%TEMP%\ddab.tmp.exe
%TEMP%\db98.tmp.exe
%TEMP%\d1d7.tmp.exe
%TEMP%\cd15.tmp.exe
%TEMP%\ad26.tmp.exe
%APPDATA%\zemcawwamtfzeq\non.pub
%APPDATA%\zemcawwamtfzeq\ecco.pub
%APPDATA%\zemcawwamtfzeq\dov.pub
%APPDATA%\zemcawwamtfzeq\aspettano.pub
%TEMP%\9d0e.tmp.exe
%APPDATA%\trxbhhnmwwpucdfw\tuo.aac
%APPDATA%\trxbhhnmwwpucdfw\qua.aac
%APPDATA%\trxbhhnmwwpucdfw\marmi.aac
%APPDATA%\trxbhhnmwwpucdfw\ambascia.aac
%TEMP%\8c3b.tmp.exe
%APPDATA%\z73580633\cleaneruninstal.exe
%TEMP%\aut8a45.tmp
%APPDATA%\z73580633\ccleanerpro.exe
%TEMP%\aut8055.tmp
%TEMP%\7f30.tmp.exe
%TEMP%\35f0.tmp.exe
%TEMP%\992.tmp.exe
%TEMP%\fc58.tmp.exe
%APPDATA%\hrjwrht
%APPDATA%\jtrbvas
%TEMP%\c61c.tmp-shm
%TEMP%\dec8.tmp-shm

Sets the 'hidden' attribute to the following files

%APPDATA%\jtrbvas
%APPDATA%\hrjwrht

Deletes the following files

%TEMP%\aut8055.tmp
%TEMP%\aut8a45.tmp
%TEMP%\c61c.tmp-shm
%TEMP%\dec8.tmp-shm

Deletes itself.

Network activity

Connects to

'17#.#11.174.48':40355
'er##rst.gq':80
'17#.#0.40.83':81
'ap#.ip.sb':443

TCP

HTTP GET requests

http://10##########older1002-0147251002202035.site/raccon.exe

HTTP POST requests

http://17#.###.174.48:40355/ via 17#.#11.174.48
http://er##rst.gq/
http://17#.#0.40.83:81/ via 17#.#0.40.83
http://10##########older1002-0147251002202035.site/

'ap#.ip.sb':443

UDP

DNS ASK 10###########lder1002002131-service1002.space
DNS ASK 10#########folder1002-01262510022020.ga
DNS ASK 10#########folder1002-01252510022020.ml
DNS ASK 10##########older100221-service1022020.ru
DNS ASK 10##########older100231-service1022020.ru
DNS ASK 10###########lder100241-service1002010022020.ru
DNS ASK 10###########lder100251-service2510022020.ru
DNS ASK 10############dert161-service100201242510022020.ru
DNS ASK 10###########t151-service100201242510022020.ru
DNS ASK 10###########est561-service1002012510022020.ru
DNS ASK 10###########est981-service1002012510022020.ru
DNS ASK 10###########est451-service1002012510022020.ru
DNS ASK 10###########est871-service1002012510022020.ru
DNS ASK 10###########est971-service1002012510022020.ru
DNS ASK 10###########est341-service1002012510022020.ru
DNS ASK 10###########est251-service1002012510022020.ru
DNS ASK 10#############er1002-service100201blog2510022020.ru
DNS ASK 10#############er1002-service100201life2510022020.ru
DNS ASK 10#########folder1002-01272510022020.cf
DNS ASK 10##########older1002-01292510022020.com
DNS ASK er##rst.gq
DNS ASK 10##########older1002-0130251002202035.site
DNS ASK 10##########older1002-0147251002202035.site
DNS ASK 10##########older1002-0146251002202035.site
DNS ASK 10##########older1002-0145251002202035.site
DNS ASK 10##########older1002-0144251002202035.site
DNS ASK 10##########older1002-0143251002202035.site
DNS ASK 10##########older1002-0142251002202035.site
DNS ASK 10##########older1002-0141251002202035.site
DNS ASK 10##########older1002-0140251002202035.site
DNS ASK 10##########older1002-0139251002202035.site
DNS ASK 10##########older1002-0138251002202035.site
DNS ASK 10##########older1002-0137251002202035.site
DNS ASK 10##########older1002-0136251002202035.site
DNS ASK 10##########older1002-0135251002202035.site
DNS ASK 10##########older1002-0134251002202035.site
DNS ASK 10##########older1002-0133251002202035.site
DNS ASK 10##########older1002-0132251002202035.site
DNS ASK 10##########older1002-0131251002202035.site
DNS ASK 10#############er1002-service100201shop2510022020.ru
DNS ASK 10#########folder1002-01282510022020.gq
DNS ASK 10###########lder241-service1002012510022020.ru
DNS ASK 10###########1-service1002012510022020.website
DNS ASK 10###########1341-service1002012510022020.ru
DNS ASK 10############671-service1002012510022020.online
DNS ASK 10###########5671-service1002012510022020.tech
DNS ASK 10###########3461-service1002012510022020.net
DNS ASK 10###########4781-service1002012510022020.info
DNS ASK 10###########3561-service1002012510022020.su
DNS ASK 10###########3481-service1002012510022020.ru
DNS ASK 10###########3531-service100201242510022020.ru
DNS ASK 10############4831-service1002012510022020.space
DNS ASK 10############7831-service1002012510022020.space
DNS ASK 10############6831-service1002012510022020.space
DNS ASK 10############5831-service1002012510022020.space
DNS ASK 10##########older33417-01242510022020.space
DNS ASK 10###########lder1002002531-service1002.space
DNS ASK 10###########lder1002002431-service1002.space
DNS ASK 10##########older3100231-service1002.space
DNS ASK 10###########lder1002002231-service1002.space
DNS ASK 10###########1-service100201dom2510022020.ru
DNS ASK 10##########51-service1002012510022020.xyz
DNS ASK 10###########lder471-service1002012510022020.ru
DNS ASK 10###########1-service100201pro2510022020.ru
DNS ASK 10###########lder481-service1002012510022020.ru
DNS ASK 10###########st361-service1002012510022020.ru
DNS ASK 10###########st371-service1002012510022020.ru
DNS ASK 10##########231-service1002012510022020.fun
DNS ASK 10###########61-service1002012510022020.host
DNS ASK 10##########571-service1002012510022020.pro
DNS ASK 10##########481-service1002012510022020.ru
DNS ASK 10##########391-service1002012510022020.ru
DNS ASK 10###########st231-service1002012510022020.ru
DNS ASK 10###########st251-service1002012510022020.ru
DNS ASK 10###########61-service1002012510022020.space
DNS ASK 10##########281-service1002012510022020.ru
DNS ASK 10###########st213-service1002012510022020.ru
DNS ASK 10############der4561-service1002012510022020.ru
DNS ASK 10###########1-service1002012510022020.press
DNS ASK 10##########21-service1002012510022020.eu
DNS ASK 10###########1-service100201rus2510022020.ru
DNS ASK 10###########lder351-service1002012510022020.ru
DNS ASK ap#.ip.sb

Miscellaneous

Creates and executes the following

'%TEMP%\fc58.tmp.exe'
'%TEMP%\992.tmp.exe'
'%TEMP%\35f0.tmp.exe'
'%TEMP%\7f30.tmp.exe'
'%APPDATA%\z73580633\ccleanerpro.exe'
'%TEMP%\8c3b.tmp.exe'
'%APPDATA%\z73580633\cleaneruninstal.exe'
'%TEMP%\9d0e.tmp.exe'
'%TEMP%\ad26.tmp.exe'
'%TEMP%\cd15.tmp.exe'
'%TEMP%\d1d7.tmp.exe'
'%TEMP%\db98.tmp.exe'
'%TEMP%\ddab.tmp.exe'
'%WINDIR%\syswow64\at.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Tuo.aac' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Dov.pub' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Tuo.aac
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Dov.pub
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
'%WINDIR%\syswow64\cmd.exe'
'%WINDIR%\syswow64\findstr.exe' /V /R "^ccKuFgzLCpaCXAoLxcVASmvtcETGgbrhzyqLNirNuGrgLlfsysmrncdVYFKwcMbtutpRAvYjaixjvizkgBAWYqPXOtMi$" Aspettano.pub
'%WINDIR%\syswow64\findstr.exe' /V /R "^MyXpqFsLpBcTeyDEturVtRkCghLdjrYnKebzOwjLEzQsSFOOBHbdWSxVTcUNUwnuDWpqHpPrUsdLqTJJnWOFFHBSHCAaunRDUKOVcOusRxvFCJUZL$" Marmi.aac
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial