ThreatExpert Report: BackDoor-BAE.dll

Submission Summary:

Submission details:

Submission received: 30 August 2012, 15:16:01
Processing time: 7 min 59 sec
Submitted sample:

File MD5: 0x48C093B0E24D65838E1EE0F5B7B4337E
File SHA-1: 0xECB9626B9A2CD0C75A078F1C17CBEAD251380BA6
Filesize: 98,304 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\antivshlp32.dll	40,960 bytes	MD5: 0xE72B0A5D85F1E9D3413745D2B696B714 SHA-1: 0xE7356AB76D223CE18845942BF62CF55123B9B686	BackDoor-BAE.dll [McAfee]
2	%System%\drivers\AppSvcHlp.sys	75,776 bytes	MD5: 0x2D613204D44FB0455EF0FA5384D5352C SHA-1: 0x19889145B193926B8FA2827C5EFF966B450B3A19	(not available)
3	[file and pathname of the sample #1]	98,304 bytes	MD5: 0x48C093B0E24D65838E1EE0F5B7B4337E SHA-1: 0xECB9626B9A2CD0C75A078F1C17CBEAD251380BA6	(not available)
4	%Windir%\Temp\103062_tep.dll	6,246 bytes	MD5: 0x3D99308391AA25A66618E79E0C5EC838 SHA-1: 0x15E80D628F72A58B52A312A22718EFAF91284FFE	(not available)

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	110,592 bytes
regedit.exe	c:\recycler\regedit.exe	417,792 bytes
[generic host process]	[generic host process filename]	45,056 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	24,576 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
antivshlp32.dll	%System%\antivshlp32.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x71000000 - 0x7100A000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppSvcHlp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HideKey
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HideKey\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppSvcHlp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HideKey
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HideKey\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG]

Trace Level = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Help]

CHTAPT.Help = "aqq&kgfaem{&kge"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HideKey"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY\0000]

Service = "HideKey"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "HideKey"
Capabilities = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDEKEY]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppSvcHlp]

Type = 0x00000001
ErrorControl = 0x00000001
Start = 0x00000000
Tag = 0x0000000A

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HideKey\Enum]

0 = "Root\LEGACY_HIDEKEY\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HideKey]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "\??\c:\recycler\hidekey.txt"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HideKey"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY\0000]

Service = "HideKey"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "HideKey"
Capabilities = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDEKEY]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppSvcHlp]

Type = 0x00000001
ErrorControl = 0x00000001
Start = 0x00000000
Tag = 0x0000000A

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HideKey\Enum]

0 = "Root\LEGACY_HIDEKEY\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HideKey]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "\??\c:\recycler\hidekey.txt"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}]

UpperFilters =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}]

UpperFilters =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cache =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

HttpTunnel@@

The following Host Name was requested from a host database:

192.5.5.241

The data identified by the following URL was then requested from the remote web server:

http://iyy.conimes.com/cgi/online.asp?hostname=ComputerName&httptype=[1][not httptunnel]

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.