Submission Summary:

• Submission details:
• Submission received: 5 October 2012, 23:23:52
• Processing time: 9 min 9 sec
• Submitted sample:
• File MD5: 0xC32786C388CDA0A307146D0688EC3D99
• File SHA-1: 0xF8093637E0C7317C3B5E73DCADCEB9602522E811
• Filesize: 177,152 bytes
• Alias:
• Backdoor.Trojan [Symantec]
• Generic BackDoor.aer [McAfee]
• Backdoor:Win32/Tenpeq.B [Microsoft]
• Backdoor.Win32.Emogen [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\win88252292c.dll	129,536 bytes	MD5: 0xC257A5A9BA8842555F187C09D6590457 SHA-1: 0x8BFFE326E29C735AF57816C2900686D344393FA8	Backdoor.Trojan [Symantec] Backdoor:Win32/Zegost.AL [Microsoft] Gen.Backdoor.Heur [Ikarus]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
win88252292c.dll	%System%\win88252292c.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xA90000 - 0xAB9000

• There was a new service created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Parameters
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Parameters
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Enum

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• UserFaultCheck = "%System%\dumprep 0 -u"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
• ID = "726F71"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
• Serverxxx-vip04 = 53 65 72 76 65 72 78 78 78 2D 76 69 70 30 34 00
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "Serverxxx-vip04"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04\0000]
• Service = "Serverxxx-vip04"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "Provides system and desktop level support to the NVIDIA displays drivers-vip04"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERXXX-VIP04]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Enum]
• 0 = "Root\LEGACY_SERVERXXX-VIP04\0000"
• Count = 0x00000001
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04\Parameters]
• ServiceDll = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 69 6E 38 38 32 35 32 32 39 32 63 2E 64 6C 6C 00 05 91 7C B8 0C 15 00 6D 05 91 7C E4 2B DD 77 46 FC 12 00 A4 16 DD 77 2A 00 00 00 D4 FB 12 00 D3 9B 91 7C 46 FC 12 00 A3 02 00 00 00 00 DD 7
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverxxx-vip04]
• Type = 0x00000110
• Start = 0x00000002
• ErrorControl = 0x00000001
• ImagePath = "%System%\svchost.exe -k "Serverxxx-vip04""
• DisplayName = "Provides system and desktop level support to the NVIDIA displays drivers-vip04"
• ObjectName = "LocalSystem"
• Description = "NVIDIA Display Driver Services-vip03"
• FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 74 00 6D 00 01 00 00 00 60 EA 00 00 01 00 00 00 60 EA 00 00 00 00 00 00 60 EA 00 00
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "Serverxxx-vip04"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04\0000]
• Service = "Serverxxx-vip04"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "Provides system and desktop level support to the NVIDIA displays drivers-vip04"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERXXX-VIP04]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Enum]
• 0 = "Root\LEGACY_SERVERXXX-VIP04\0000"
• Count = 0x00000001
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04\Parameters]
• ServiceDll = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 69 6E 38 38 32 35 32 32 39 32 63 2E 64 6C 6C 00 05 91 7C B8 0C 15 00 6D 05 91 7C E4 2B DD 77 46 FC 12 00 A4 16 DD 77 2A 00 00 00 D4 FB 12 00 D3 9B 91 7C 46 FC 12 00 A3 02 00 00 00 00 DD 7
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverxxx-vip04]
• Type = 0x00000110
• Start = 0x00000002
• ErrorControl = 0x00000001
• ImagePath = "%System%\svchost.exe -k "Serverxxx-vip04""
• DisplayName = "Provides system and desktop level support to the NVIDIA displays drivers-vip04"
• ObjectName = "LocalSystem"
• Description = "NVIDIA Display Driver Services-vip03"
• FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 74 00 6D 00 01 00 00 00 60 EA 00 00 01 00 00 00 60 EA 00 00 00 00 00 00 60 EA 00 00

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
• (Default) =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
• (Default) =
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
• Cookies =
• History =

Other details

• The data identified by the following URL was then requested from the remote web server:
• http://14.206.5.163/ip/vip04.txt

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 0: