ThreatExpert Report: Trojan.Win32.ServStart, Mal/Nitol-C, Trojan:Win32/Nitol.A..

Submission Summary:

Submission details:

Submission received: 17 September 2012, 20:33:13
Processing time: 7 min 49 sec
Submitted sample:

File MD5: 0x6A3DD605B1BBF226D03FC0288C8C0178
File SHA-1: 0xEF934846501D1ECED6780E851987B41B0CF1C0E2
Filesize: 50,688 bytes
Alias: Trojan.Win32.ServStart [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Microsoft\Installer\{B53D42E8-872B-430E-82D4-80065A31FCE1}\lpk.dll [pathname with a string SHARE]\lpk.dll [pathname with a string SHARE]\lpk.dll [pathname with a string SHARE]\lpk.dll %ProgramFiles%\Internet Explorer\Connection Wizard\lpk.dll %ProgramFiles%\Internet Explorer\lpk.dll %ProgramFiles%\Messenger\lpk.dll %ProgramFiles%\Web Publish\lpk.dll %ProgramFiles%\Windows NT\lpk.dll %ProgramFiles%\WinPcap\lpk.dll %System%\gei33.dll	60,416 bytes	MD5: 0x52ABD8742F4F21661C625C815A765B69 SHA-1: 0xC9E60B1A3D29794C2E41E852DBF748FFB0DE07DD	Mal/Nitol-C [Sophos] Trojan:Win32/Nitol.A [Microsoft] Trojan.Win32.Patcher [Ikarus]
2	%Temp%\SOFTWARE.LOG %System%\ookyou.exe	50,688 bytes	MD5: 0x6A3DD605B1BBF226D03FC0288C8C0178 SHA-1: 0xEF934846501D1ECED6780E851987B41B0CF1C0E2	Trojan.Win32.ServStart [Ikarus]

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
ookyou.exe	%System%\ookyou.exe	77,824 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	77,824 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
gei33.dll	%System%\gei33.dll	Process name: ookyou.exe Process filename: %System%\ookyou.exe Address space: 0x3E0000 - 0x3F3000

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
eqtgjoparm	owzdqyoxytjbbhawdydc	"Running"	%System%\ookyou.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "eqtgjoparm"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM\0000]

Service = "eqtgjoparm"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "owzdqyoxytjbbhawdydc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EQTGJOPARM]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm\Enum]

0 = "Root\LEGACY_EQTGJOPARM\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eqtgjoparm]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\ookyou.exe"
DisplayName = "owzdqyoxytjbbhawdydc"
ObjectName = "LocalSystem"
Description = "prjbxphoohpkwqyuhrqzhnbnfuvqnq"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "eqtgjoparm"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM\0000]

Service = "eqtgjoparm"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "owzdqyoxytjbbhawdydc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EQTGJOPARM]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm\Enum]

0 = "Root\LEGACY_EQTGJOPARM\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eqtgjoparm]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\ookyou.exe"
DisplayName = "owzdqyoxytjbbhawdydc"
ObjectName = "LocalSystem"
Description = "prjbxphoohpkwqyuhrqzhnbnfuvqnq"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

eqtgjoparm

The following ports were open in the system:

Port	Protocol	Process
1033	TCP	ookyou.exe (%System%\ookyou.exe)
1034	TCP	ookyou.exe (%System%\ookyou.exe)

The following Host Names were requested from a host database:

192.5.5.241
coant5.vicp.net
rat2.100geili.com

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
coant5.vicp.net	8099
rat2.100geili.com	8000

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 8099:

00000000 | 6401 0000 7700 0000 4500 6E00 6700 6C00 | d...w...E.n.g.l.
00000010 | 6900 7300 6800 2000 2800 5500 6E00 6900 | i.s.h. .(.U.n.i.
00000020 | 7400 6500 6400 2000 5300 7400 6100 7400 | t.e.d. .S.t.a.t.
00000030 | 6500 7300 2900 0000 0000 0000 0000 0000 | e.s.)...........
00000040 | 0000 0000 0000 0000 434F 4D50 5554 4552 | ........COMPUTER
00000050 | 4E41 4D45 0000 0000 0000 0000 0000 0000 | NAME............
00000060 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000070 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000080 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000090 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000A0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000B0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000C0 | 0000 0000 0000 0000 5769 6E58 5000 0000 | ........WinXP...
000000D0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000E0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000F0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000100 | 0000 0000 0000 0000 3235 3620 4D42 0000 | ........256 MB..
00000110 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000120 | 0000 0000 0000 0000 3239 3939 204D 487A | ........2999 MHz
00000130 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000140 | 0000 0000 0000 0000 39D4 C231 36C8 D500 | ........9..16...
00000150 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000160 | 0000 0000 0200 0000 107C 0100           | .........|..

There was an outbound traffic produced on port 8000:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.