Win32.Rmnet.17

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe

Substitutes the following executable system files:

<SYSTEM32>\dllcache\msdaenum.dll with <SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdadc.dll with <SYSTEM32>\dllcache\msdadc.dll.new
<SYSTEM32>\dllcache\msdfmap.dll with <SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaorar.dll with <SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdaora.dll with <SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\msdaer.dll with <SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaremr.dll with <SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msaddsr.dll with <SYSTEM32>\dllcache\msaddsr.dll.new
<SYSTEM32>\dllcache\msadds.dll with <SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msadcs.dll with <SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdarem.dll with <SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msdaprst.dll with <SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll with <SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msdaosp.dll with <SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\oledb32r.dll with <SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\oledb32.dll with <SYSTEM32>\dllcache\oledb32.dll.new
<SYSTEM32>\dllcache\msxactps.dll with <SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\wab32res.dll with <SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\wab32.dll with <SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll with <SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msdaurl.dll with <SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\msdasql.dll with <SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\msdasc.dll with <SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdaps.dll with <SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msdatt.dll with <SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\msdatl3.dll with <SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll with <SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\mssoapr.dll with <SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\mssoap1.dll with <SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\fp4autl.dll with <SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\spttseng.dll with <SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\spcommon.dll with <SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\wisc10.dll with <SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\vgx.dll with <SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\spcplui.dll with <SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\dao360.dll with <SYSTEM32>\dllcache\dao360.dll.new
<SYSTEM32>\dllcache\triedit.dll with <SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\sapi.dll with <SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\msader15.dll with <SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\msadcf.dll with <SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msadcer.dll with <SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadce.dll with <SYSTEM32>\dllcache\msadce.dll.new
<SYSTEM32>\dllcache\msadcor.dll with <SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msadco.dll with <SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcfr.dll with <SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\directdb.dll with <SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msador15.dll with <SYSTEM32>\dllcache\msador15.dll.new
<SYSTEM32>\dllcache\msadomd.dll with <SYSTEM32>\dllcache\msadomd.dll.new
<SYSTEM32>\dllcache\msado15.dll with <SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\msjro.dll with <SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\msadrh15.dll with <SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadox.dll with <SYSTEM32>\dllcache\msadox.dll.new

Infects the following executable files:

C:\Far2\Plugins\MacroView\MacroView.dll
C:\Far2\Plugins\Network\Network.dll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
C:\Far2\Plugins\FarCmds\FARCmds.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\ProcList\Proclist.dll
%CommonProgramFiles%\System\Ole DB\MSDAIPP.DLL
%PROGRAM_FILES%\FireFox\AccessibleMarshal.dll
%CommonProgramFiles%\Microsoft Shared\VC\msdia80.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Plugins\WinSCP\WinSCP.dll
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\FExcept\FExcept.dll
C:\Far2\Plugins\7-Zip\7-ZipFar.dll
C:\Far2\FExcept\ExcDump.dll
C:\Far2\Far.exe
C:\Far2\FExcept\demangle32.dll
C:\Far2\Plugins\arclite\7z.dll
C:\Far2\Plugins\Compare\Compare.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\arclite\arclite.dll
C:\Far2\Plugins\Brackets\Brackets.dll

Malicious functions:

Creates and executes the following:

'%TEMP%\empchqloliakgweu.exe'

Injects code into

the following system processes:

<SYSTEM32>\alg.exe
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\cscript.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\services.exe
%WINDIR%\Explorer.EXE
<SYSTEM32>\svchost.exe

a large number of user processes.

Searches for registry branches where third party applications store passwords:

[<HKLM>\Software\Ghisler\Total Commander]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKLM>\Software\FlashFXP]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\FlashFXP]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
[<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]

Modifies settings of Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'

Modifies file system :

Creates the following files:

%TEMP%\~TM6.tmp
%TEMP%\~TM5.tmp
%TEMP%\tssofofu.sys
%WINDIR%\Temp\7fffffb1
%WINDIR%\Temp\6decd52f
%TEMP%\~TM4.tmp
%TEMP%\~TM2.tmp
%TEMP%\~TM1.tmp
%TEMP%\empchqloliakgweu.exe
%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe
<LS_APPDATA>\niuydqre.log

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe

Deletes the following files:

%TEMP%\~TM5.tmp
%TEMP%\~TM6.tmp
%TEMP%\tssofofu.sys
%TEMP%\~TM1.tmp
%TEMP%\~TM2.tmp
%TEMP%\~TM4.tmp

Network activity:

Connects to:

'74.##5.232.51':80

UDP:

DNS ASK lm####enskxs.com
DNS ASK ui###xytj.com
DNS ASK fi#####tyqixemglomx.com
DNS ASK vv###iteuy.com
DNS ASK sg####rmsiopg.com
DNS ASK hd###dvla.com
DNS ASK he#####dkgrymjrq.com
DNS ASK hq###vnty.com
DNS ASK xk####himumw.com
DNS ASK ot####llcsbltf.com
DNS ASK li#####fvircwvtijkh.com
DNS ASK as###bwpms.com
DNS ASK ck####ryyfbjew.com
DNS ASK bx####qujsgq.com
DNS ASK ba####pkvhohj.com
DNS ASK gb###wqacn.com
DNS ASK it#####iceydiploubs.com
DNS ASK lw###iwoe.com
DNS ASK iu###utgmv.com
DNS ASK fh#####axrfptgifkw.com
DNS ASK ka###pobu.com
DNS ASK rr#####kpfjyoqmutl.com
DNS ASK bo#####ylfapinygm.com
DNS ASK it####dlmqlfi.com
DNS ASK mp###pgi.com
DNS ASK qc####yghmdqvwg.com
DNS ASK gu#####iekcjtbolscm.com
DNS ASK ft####savmbpulv.com
DNS ASK ya##o.com
DNS ASK ke###gaxlkx.com
DNS ASK yc#####fkalqeksvbdd.com
DNS ASK ql####saavjqugh.com
DNS ASK ou###jxapd.com
DNS ASK ic###fanne.com
DNS ASK xy###apyp.com
DNS ASK ln#####ivuiwiymt.com
DNS ASK gu####ndwwdcjn.com
DNS ASK ym####wjcutoy.com
DNS ASK up#####altqvuelscol.com
DNS ASK ys####placlurpr.com
DNS ASK hj####tmbvql.com
DNS ASK iu#####ffgbxbcijdeb.com
DNS ASK jm#####rpxffppwyqj.com
DNS ASK lw#####mrdvncihd.com
DNS ASK vx###grau.com
DNS ASK hf####dycdwti.com
DNS ASK kj###wnxbk.com
DNS ASK xk####rnedplpte.com
DNS ASK pl###qynxj.com
DNS ASK go#####unccajymh.com
DNS ASK jn####hekqoipte.com
DNS ASK nu###cgghxu.com
DNS ASK fh####mcifit.com
DNS ASK cn###wkwr.com
DNS ASK uh####xaiusx.com
DNS ASK en#####evthmcmojixr.com
DNS ASK bg#####kpchokesy.com
DNS ASK io####qeraxic.com
DNS ASK xs####idceqdbr.com
DNS ASK ub###xembk.com
DNS ASK as###ifg.com
DNS ASK xt###dvpk.com
DNS ASK ov###ngejmo.com
DNS ASK ym####nulihl.com
DNS ASK qw#####kdppgqeha.com
DNS ASK ys#####bqfkvkojv.com
DNS ASK lu###txaymj.com
DNS ASK fw#####rvkuqjclvy.com
DNS ASK fm#####irxxgbupuxq.com
DNS ASK hq####mvtush.com
DNS ASK af###gwn.com
DNS ASK eg###jyeasr.com
DNS ASK rh####rmnacbg.com
DNS ASK xe###vlmob.com
DNS ASK pl###qjfynt.com
DNS ASK bv###xcfobr.com
DNS ASK ky###xbydck.com
DNS ASK uu####xvihatsr.com
DNS ASK cn#####axkredxnk.com
DNS ASK bp###gre.com
DNS ASK it####ufaixmin.com
DNS ASK tt#####nivtsybduyb.com
DNS ASK fj####uyyppsei.com
DNS ASK google.com
DNS ASK jr#####kvhgsiyknhw.com
DNS ASK cm####kxqgxxtbk.com
DNS ASK jy###ogwr.com
DNS ASK nt###vejb.com
DNS ASK wa#####ygowhbdfn.com
DNS ASK lh#####bwenxtyae.com
DNS ASK la###dbqqr.com
DNS ASK as####nbyioy.com
DNS ASK mw###rlf.com
DNS ASK lc####tgdgqoba.com
DNS ASK bing.com
DNS ASK my#####nhuxplwifpo.com
DNS ASK dd####srdhtprae.com
DNS ASK bj###tlg.com
DNS ASK tr####kctoktsl.com
DNS ASK oh####mnlsyjwpp.com
DNS ASK ce###xswsg.com
DNS ASK dj#####rljlrkdqr.com
DNS ASK wp###lsc.com
DNS ASK ui#####frpoafrpjxd.com
DNS ASK xm####hkgjiif.com
DNS ASK dl###ung.com
DNS ASK bo###eqadbm.com
DNS ASK ry####ioyrcsu.com
DNS ASK md####svdqbxp.com
DNS ASK vw#####rpuurtusi.com
DNS ASK hk###mpjeg.com
DNS ASK ka#####paanwnuopbj.com
DNS ASK lm####mkmpayyu.com
DNS ASK gv#####sdmjqufbfgdg.com
DNS ASK si####rsxdqmvq.com
DNS ASK yp####matxojboh.com
DNS ASK nt#####fxonbvkqed.com
DNS ASK bo###svsvt.com
DNS ASK rm####lnycyft.com
DNS ASK qa####dglsnraye.com
DNS ASK ei####sddpwxl.com
DNS ASK ru#####qxveivksuvi.com
DNS ASK xw####gjrikdwy.com
DNS ASK wh####fgvpyr.com
DNS ASK dh###btnxja.com

Technologies

Terminology

Training and education

Myths

Technical Information