Trojan.Siggen14.53922

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\iNode DAM Agent] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\iNode DAM Agent] 'ImagePath' = '"C:\iNode DAM Agent\EFF647AF0178A74E8C0D1A38795459CB\DamAgent.exe" -startService'

Creates the following services

'iNode DAM Agent' "C:\iNode DAM Agent\EFF647AF0178A74E8C0D1A38795459CB\DamAgent.exe" -startService

Malicious functions

Executes the following

Modifies file system

Creates the following files

C:\inodelog\stp_utlsvrhelp2021080403.log
<SYSTEM32>\chkread.dll
%WINDIR%\syswow64\chkread.dll
%WINDIR%\syswow64\apiread.exe
%WINDIR%\syswow64\hssvchost.exe
%WINDIR%\syswow64\damagenttray.exe
<SYSTEM32>\damagent.exe
%WINDIR%\syswow64\damagent.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\chkread.dll
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\apiread.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\svchost.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\log\damagent.2021080403.log
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\keyoffice.vbs
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent_zh.res
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent.ini
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\languages.ini
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\shut2003.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damassist.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagenttray.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent64.exe
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent32.exe
C:\inodelog\stp_utlfile2021080403.log
C:\inodelog\damsetup2021080403.log
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent_en.res
C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\log\damagenttray.2021080403.log

Moves the following files

from C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent_en.res to C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\resources\en-us\damagent.res
from C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent_zh.res to C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\resources\zh-cn\damagent.res
from C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent64.exe to C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent.exe

Network activity

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent.exe'
'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent.exe' -startService
'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\svchost.exe' Microsoft
'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagenttray.exe' zhiMaKai ^men9
'%WINDIR%\syswow64\taskkill.exe' /F /IM "iNodeLvdun.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "iNodeDlpAgent.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "LdMainControl.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "ldbusiness_32.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "ldbusiness_64.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "LdContentAware.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "LdFileGate.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "LdMsgInject.exe"' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM "LdMsgInject64.exe"' (with hidden window)
'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\damagent.exe' ' (with hidden window)
'C:\inode dam agent\eff647af0178a74e8c0d1a38795459cb\svchost.exe' Microsoft' (with hidden window)
'<SYSTEM32>\mountvol.exe' /L' (with hidden window)

Executes the following