Submission Summary:

• Submission details:
• Submission received: 8 December 2008, 19:03:50
• Processing time: 5 min 54 sec
• Submitted sample:
• File MD5: 0x3E0EFC6089A4A5C42AF28155101CE712
• File SHA-1: 0x6CE4145D64B624B0206A1F00B6B3F7AB0149A194
• Filesize: 151,552 bytes
• Alias:
• Trojan-Downloader.Agent!sd6 [PCTools]
• Trojan-Downloader.Win32.Agent.aseo [Kaspersky Lab]
• Generic.dx [McAfee]
• TrojanDownloader:Win32/Tracur.A [Microsoft]
• Trojan-Dropper.Agent [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Uses the AppInit_DLLs value in order to install a module that will be loaded into the address space of every running application.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Downloader.Agent!sd6	Trojan-Downloader.Agent!sd6 attempts to download malicious files to the local computer and execute them.

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\020000006175b901509C.manifest	13 bytes	MD5: 0xE6EC68259B9A2B2A7C04BC074186B5FE SHA-1: 0x55656CE73CD2D7AD3EA7A0C23AF1D07F143EE28C	(not available)
2	%AppData%\020000006175b901509O.manifest	11 bytes	MD5: 0x82908D032137FFBF20736FCC19217EFA SHA-1: 0x40E083334CE0BC1428E007179810AEDF7276E9B2	(not available)
3	%AppData%\020000006175b901509P.manifest	517 bytes	MD5: 0xFC66E294A453EB6C7F2B6389523CAE41 SHA-1: 0xBF0D3C20FE66E312268BA9A8211D5D2E3FE6252A	(not available)
4	%AppData%\020000006175b901509S.manifest	11 bytes	MD5: 0xF71D12EA086C28D0AEC2EA20EC3F15D9 SHA-1: 0x70379C4525725655277DA68EFF7DBB2D1F8DD79C	(not available)
5	%System%\dpserial32.dll	135,168 bytes	MD5: 0x8F888332700F39CCB90CEB0C35C9EBD8 SHA-1: 0xB68874F7B4D0190B191F1ACF1E113A670DEA00C1	Trojan-Downloader.Agent!sd6 [PCTools] Trojan-Downloader.Win32.Agent.arsg [Kaspersky Lab] Mal/Behav-027, Mal/Behav-010 [Sophos] TrojanDownloader:Win32/Tracur.A [Microsoft] Trojan-Dropper.Agent [Ikarus]
6	[file and pathname of the sample #1]	151,552 bytes	MD5: 0x3E0EFC6089A4A5C42AF28155101CE712 SHA-1: 0x6CE4145D64B624B0206A1F00B6B3F7AB0149A194	Trojan-Downloader.Agent!sd6 [PCTools] Trojan-Downloader.Win32.Agent.aseo [Kaspersky Lab] Generic.dx [McAfee] TrojanDownloader:Win32/Tracur.A [Microsoft] Trojan-Dropper.Agent [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
dpserial32.dll	%System%\dpserial32.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x10000000 - 0x10022000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs
wscsvc	Security Center	"Stopped"	%System%\svchost.exe -k netsvcs

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cd1a40509

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
• cd1a40 = 30 91 85 57 55 32 C9 01
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cd1a40509]
• DllName = "%System%\dpserial32.dll"
• Startup = "EventStartup"

so that dpserial32.dll is installed as a Winlogon notification package

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
• AppInit_DLLs = "%System%\dpserial32.dll"

so that dpserial32.dll runs every time a Windows application starts

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
• (Default) = 0x0000000D
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
• (Default) = 0x0000000D

Other details

• To mark the presence in the system, the following Mutex object was created:
• DBWinMutex

• The following Internet Connection was established: