ThreatExpert Report: Malware.Imaut, W32.Imaut, IM-Worm.Win32.Sohanad.qi, W32/Ramnit.a, Mal/Sohana-A..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 26 April 2011, 01:47:14
Processing time: 8 min 40 sec
Submitted sample:

File MD5: 0x48721C5383FDC01359C8125139CB9AB0
File SHA-1: 0xC83DA3EB30CD507B732AF1A99D8F318338841D80
Filesize: 1,198,085 bytes
Alias:

Malware.Imaut [PCTools]
W32.Imaut [Symantec]
IM-Worm.Win32.Sohanad.qi [Kaspersky Lab]
W32/Ramnit.a [McAfee]
Mal/Sohana-A [Sophos]
Worm:Win32/Nuqel.AE [Microsoft]
Trojan.Autoit [Ikarus]
Win32/Ramnit.F [AhnLab]

Summary of the findings:

What's been found	Severity Level
Capability to block security-related software by modifying firewall settings and by disabling security services, such as Windows Update, Norton Autoprotect, Kaspersky Anti-Virus, etc.
Produces outbound traffic.
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
There were some system executable files modified, which might indicate the presence of a PE-file infector.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Microsoft\WaterMark.exe [part of the sample filename]1mgr.exe	252,985 bytes	MD5: 0xBB0CE6D96FEF4BEABD43ECE95D6A00A8 SHA-1: 0x465279B83362B977EC37F4F0D4229B8A0DE213AE	HeurEngine.Protexor [PCTools] Packed.Protexor!gen1 [Symantec] Packed.Win32.Krap.ar [Kaspersky Lab]
2	%Windir%\regsvr.exe %System%\regsvr.exe [file and pathname of the sample #1] %System%\svchost .exe	1,198,085 bytes	MD5: 0x48721C5383FDC01359C8125139CB9AB0 SHA-1: 0xC83DA3EB30CD507B732AF1A99D8F318338841D80	Malware.Imaut [PCTools] W32.Imaut [Symantec] IM-Worm.Win32.Sohanad.qi [Kaspersky Lab] W32/Ramnit.a [McAfee] Mal/Sohana-A [Sophos] Worm:Win32/Nuqel.AE [Microsoft] Trojan.Autoit [Ikarus] Win32/Ramnit.F [AhnLab]
3	%System%\28463\svchost.001	2,800 bytes	MD5: 0xC427F41A9EB12166C278DA8FED8A0C4A SHA-1: 0xE0E1D1C8F6B58675A544F1461997CFC37A2E6C63	IM-Worm.Win32.Sohanad.it [Kaspersky Lab] IM-Worm.Win32.Sohanad [Ikarus]
4	%System%\dmlconf.dat	16 bytes	MD5: 0xC76CD1F2FF25EF0DF1ACC6BAFF1E6031 SHA-1: 0xF1B820A475E3E27211C3B32209A0274A1B780A70	(not available)
5	%System%\setting.ini	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
6	%System%\setup.ini	96 bytes	MD5: 0x9ECE103C47335F0CC777F1132B8D522F SHA-1: 0x63AFA171C64F86D99DB81723E1335E960E85FA43	Trojan.Autorun!ct [PCTools] Trojan.Win32.AutoRun.ke [Kaspersky Lab] Generic!atr [McAfee] Troj/Agent-GXM [Sophos] Trojan.Win32.AutoRun [Ikarus] TextImage/Autorun [AhnLab]
7	%Windir%\Tasks\At1.job	350 bytes	MD5: 0x0D7CB353D0F36B2E9E663254F0AF23D3 SHA-1: 0xE9095BC36813BD4F0A55DADCD0FB3A75C4C5874C	(not available)
8	%Windir%\Tasks\At2.job	350 bytes	MD5: 0x46D9DDCE7E392DE21DEE0031BC8A4C47 SHA-1: 0x094645F3ED75EB455088A92DDBC49AEC636C7DCF	(not available)

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following files were modified:

c:\contacts.html
c:\Inetpub\wwwroot\index.html
[pathname with a string SHARE]\msinfo32.exe
[pathname with a string SHARE]\sapisvr.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
%ProgramFiles%\Internet Explorer\iedw.exe
%ProgramFiles%\MSN\MSNIA\msniasvc.exe
%ProgramFiles%\MSN\MSNIA\prestp.exe
%ProgramFiles%\MSN\MsnInstaller\msninst.exe
%ProgramFiles%\NetMeeting\cb32.exe
%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\oemig50.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Web Publish\WPWIZ.EXE
%ProgramFiles%\Windows Media Player\migrate.exe
%ProgramFiles%\Windows Media Player\mplayer2.exe
%ProgramFiles%\Windows Media Player\setup_wm.exe
%ProgramFiles%\Windows Media Player\wmplayer.exe
%ProgramFiles%\Windows NT\Accessories\wordpad.exe
%ProgramFiles%\Windows NT\dialer.exe
%ProgramFiles%\Windows NT\hypertrm.exe
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE
%Windir%\Cache\Adobe Reader 6.0.1\ENUBIG\setup.exe
%Windir%\hh.exe
%Windir%\inf\unregmp2.exe
%Windir%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%Windir%\Microsoft.NET\Framework\NETFXSBS10.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%Windir%\msagent\agentsvr.exe
%Windir%\mui\muisetup.exe
%Windir%\NOTEPAD.EXE
%Windir%\pchealth\helpctr\binaries\HelpCtr.exe
%Windir%\pchealth\helpctr\binaries\HelpHost.exe
%Windir%\pchealth\helpctr\binaries\HelpSvc.exe
%Windir%\pchealth\helpctr\binaries\HscUpd.exe
%Windir%\pchealth\helpctr\binaries\msconfig.exe
%Windir%\pchealth\helpctr\binaries\notiflag.exe
%Windir%\pchealth\UploadLB\Binaries\UploadM.exe
%Windir%\regedit.exe
%System%\accwiz.exe
%System%\actmovie.exe
%System%\ahui.exe
%System%\arp.exe
%System%\asr_fmt.exe
%System%\asr_ldm.exe
%System%\asr_pfu.exe
%System%\at.exe
%System%\atmadm.exe
%System%\attrib.exe
%System%\auditusr.exe
%System%\blastcln.exe
%System%\bootcfg.exe
%System%\bootok.exe
%System%\bootvrfy.exe
%System%\cacls.exe
%System%\calc.exe
%System%\charmap.exe
%System%\chkdsk.exe
%System%\chkntfs.exe
%System%\cidaemon.exe
%System%\cipher.exe
%System%\cisvc.exe
%System%\ckcnv.exe
%System%\cleanmgr.exe
%System%\clean_all.exe
%System%\cliconfg.exe
%System%\clipbrd.exe
%System%\clipsrv.exe
%System%\cmd.exe
%System%\cmdl32.exe
%System%\cmmon32.exe
%System%\cmstp.exe
%System%\Com\comrepl.exe
%System%\Com\comrereg.exe
%System%\comp.exe
%System%\compact.exe
%System%\conime.exe
%System%\control.exe
%System%\convert.exe
%System%\cscript.exe
%System%\ctfmon.exe

The following directories were created:

c:\System Volume Information\.
c:\System Volume Information\..
%ProgramFiles%\Microsoft
%System%\28463

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,380,352 bytes
regsvr.exe	%System%\regsvr.exe	1,380,352 bytes
regsvr.exe	%Windir%\regsvr.exe	1,380,352 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	36,864 bytes
lsass.exe	%System%\lsass.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	344,064 bytes
svchost.exe	%System%\svchost.exe	53,248 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The newly created Registry Values are:

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer]

UpdateHost = 00 50 5B C1 C2 43

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

ProxyEnable = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

NofolderOptions = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

DisableTaskMgr = 0x00000000
DisableRegistryTools = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Msn Messsenger = "%System%\regsvr.exe"

so that regsvr.exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell =
Userinit =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies =
Cache =
History =

Other details

Analysis of the file resources indicate the following possible country of origin:

United Kingdom

The following port was open in the system:

Port	Protocol	Process
1057	TCP	[file and pathname of the sample #1]

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
209.191.122.70	80
67.195.160.76	80
91.193.194.67	80
98.137.149.56	80

The data identified by the following URLs was then requested from the remote web server:

http://yahoo.com/setting.doc
http://yahoo.com/setting.xls
http://www.yahoo.com/setting.doc
http://www.yahoo.com/setting.xls

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 80:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.