Trojan.DownLoader26.46053

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '{e2803110-78b3-4664-a479-3611a381656a}' = '"%ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\V...

Modifies file system:

Creates the following files:

%TEMP%\is-BQD9N.tmp\<File name>.tmp
<SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-string-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll
<SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-util-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll
<SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-file-l2-1-0.dll
<SYSTEM32>\api-ms-win-core-file-l1-2-0.dll
<SYSTEM32>\api-ms-win-core-file-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
<SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll
<SYSTEM32>\mfcm140.dll
%WINDIR%\Installer\MSI4.tmp
C:\Config.Msi\37095.rbs
<SYSTEM32>\mfc140.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140u.dll
%WINDIR%\Installer\37094.ipi
%WINDIR%\Installer\37092.msi
<SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll
<SYSTEM32>\ucrtbase.dll
%TEMP%\dd_vcredist_x86_20180517010421_001_vcRuntimeAdditional_x86.log
%WINDIR%\Installer\37091.msi
<SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\api-ms-win-core-console-l1-1-0.dll
<SYSTEM32>\concrt140.dll
<SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll
<SYSTEM32>\msvcp140.dll
C:\Config.Msi\37090.rbs
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\3708f.ipi
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.xml
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\license.rtf
<SYSTEM32>\mfcm140u.dll
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll
%TEMP%\is-QULLV.tmp\vcredist_x86_2015_VSU3.exe
%TEMP%\Setup Log 2018-05-17 #001.txt
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\thm.wxl
<SYSTEM32>\mfc140enu.dll
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\thm.wxl
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\state.rsm
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeMinimum_x86
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeAdditional_x86
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\thm.wxl
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cab54A5CABBE7274D8A22EB58060AAB7623
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cabB3E1576D1FEFBB979E13B1A5379E0B16
%TEMP%\dd_vcredist_x86_20180517010421_000_vcRuntimeMinimum_x86.log
%WINDIR%\Installer\3708d.msi
%ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\VC_redist.x86.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
%TEMP%\dd_vcredist_x86_20180517010421.log
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\BootstrapperApplicationData.xml
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
%WINDIR%\Installer\37096.msi

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\BootstrapperApplicationData.xml
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.xml
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\thm.wxl
C:\Config.Msi\37090.rbs
%WINDIR%\Installer\3708d.msi
%WINDIR%\Installer\3708f.ipi
%WINDIR%\Installer\MSI4.tmp
C:\Config.Msi\37095.rbs
%WINDIR%\Installer\37092.msi
%WINDIR%\Installer\37094.ipi
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\thm.wxl
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\license.rtf
%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll

Moves the following files:

from %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeMinimum_x86 to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86
from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86 to %ALLUSERSPROFILE%\Application Data\Package Cache\{BBF2AC74-720C-3CB3-8291-5E34039232FA}v14.0.24215\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
from %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cab54A5CABBE7274D8A22EB58060AAB7623 to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623
from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623 to %ALLUSERSPROFILE%\Application Data\Package Cache\{BBF2AC74-720C-3CB3-8291-5E34039232FA}v14.0.24215\packages\vcRuntimeMinimum_x86\cab1.cab
from %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeAdditional_x86 to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86
from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86 to %ALLUSERSPROFILE%\Application Data\Package Cache\{69BCE4AC-9572-3271-A2FB-9423BDA36A43}v14.0.24215\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
from %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cabB3E1576D1FEFBB979E13B1A5379E0B16 to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16
from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16 to %ALLUSERSPROFILE%\Application Data\Package Cache\{69BCE4AC-9572-3271-A2FB-9423BDA36A43}v14.0.24215\packages\vcRuntimeAdditional_x86\cab1.cab

Network activity:

Connects to:

'wp#d':80
'20#.#6.232.182':80

TCP:

HTTP GET requests:

http://11#.#11.111.1/wpad.dat via wp#d
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl via 20#.#6.232.182
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl via 20#.#6.232.182
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl via 20#.#6.232.182

UDP:

DNS ASK wp#d
DNS ASK crl.microsoft.com

Miscellaneous:

Creates and executes the following:

'%TEMP%\is-BQD9N.tmp\<File name>.tmp' /SL5="$30092,17856756,57856,<Full path to file>"
'%TEMP%\is-QULLV.tmp\vcredist_x86_2015_VSU3.exe' /q
'%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe' -q -burn.elevated BurnPipe.{0983870A-A91C-435E-B116-2D76214CE310} {6D1A3F04-5814-471B-A3CD-B11D5C5C9BF5} 2856

Executes the following:

'<SYSTEM32>\msiexec.exe' /V

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial