ThreatExpert Report: Win-Trojan/Xema.variant, Trojan.Win32.Agent.cfnt, BackDoor-CKB.gen.q..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 28 May 2009, 09:08:12
Processing time: 5 min 49 sec
Submitted sample:

File MD5: 0xDDFF22A7987761A64B977FD75D9D75F2
File SHA-1: 0x0159B45F8170EAC7EBCE9D0A2C54D35F1685EAD9
Filesize: 66,048 bytes
Alias & packer info:

Win-Trojan/Xema.variant [AhnLab]
packed with: PE_Patch.UPX [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\Server.dll %System%\ServerGMH.dll	131,072 bytes	MD5: 0xFBA81E39B82D7EBB39B795DF31DD15AE SHA-1: 0xC3B16E819435DCF7C19BDAA9C6959370C597B3DA	Trojan.Win32.Agent.cfnt [Kaspersky Lab] BackDoor-CKB.gen.q [McAfee] Mal/Behav-024, Mal/Emogen-Y [Sophos] Backdoor:Win32/PcClient.DT [Microsoft] Backdoor [Ikarus]
2	[file and pathname of the sample #1]	66,048 bytes	MD5: 0xDDFF22A7987761A64B977FD75D9D75F2 SHA-1: 0x0159B45F8170EAC7EBCE9D0A2C54D35F1685EAD9	Win-Trojan/Xema.variant [AhnLab] packed with PE_Patch.UPX [Kaspersky Lab]
3	%System%\ServerGMH.ini	52 bytes	MD5: 0x71DDD1A1B1543199012F72107E25B12E SHA-1: 0x138B8217326B7904C572387B37D28C5A698B555A	(not available)

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	163,840 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
servergmh.dll	%System%\servergmh.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xA90000 - 0xAB1000

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
$GMH	$ServerGMH	"Running"	%System%\svchost.exe -k netsvcs

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "$GMH"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH\0000]

Service = "$GMH"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "$ServerGMH"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_$GMH]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Enum]

0 = "Root\LEGACY_$GMH\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH\Parameters]

ServiceDll = "%System%\ServerGMH.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\$GMH]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
DisplayName = "$ServerGMH"
ObjectName = "LocalSystem"
Description = "ï¿½Ãºï¿½ï¿½ï¿½Ô¶ï¿½Ì¼à¶½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ë³ï¿½ï¿½ï¿½"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "$GMH"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH\0000]

Service = "$GMH"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "$ServerGMH"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_$GMH]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Enum]

0 = "Root\LEGACY_$GMH\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH\Parameters]

ServiceDll = "%System%\ServerGMH.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$GMH]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
DisplayName = "$ServerGMH"
ObjectName = "LocalSystem"
Description = "ï¿½Ãºï¿½ï¿½ï¿½Ô¶ï¿½Ì¼à¶½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ë³ï¿½ï¿½ï¿½"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

netsvcs = "6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies = "%Profiles%\LocalService\Cookies"
History = "%Profiles%\LocalService\Local Settings\History"

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The following Host Name was requested from a host database:

kouchangjin.3322.org

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
kouchangjin.3322.org	800

The data identified by the following URL was then requested from the remote web server:

http://gmhyc.vip5944.com/RegUser/10000.txt

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 800:

00000000 | 5941 4E47 5A29 0100 00B8 0100 0078 9C4B | YANGZ).......x.K
00000010 | 0B5F 5A38 8781 8181 1588 1981 5883 8B81 | ._Z8........X...
00000020 | 8109 4807 A716 9565 26A7 2A04 2426 672B | ..H....e&.*.$&g+
00000030 | 1831 306C 9ED7 5003 1466 28E5 6EAC D9CE | .10l..P..f(.n...
00000040 | 800A 9E44 AD00 D327 5827 D644 FCE0 62D8 | ...D...'X'.D..b.
00000050 | 10BD 8221 10C8 5EC1 CEC9 900B A417 8BAD | ...!..^.........
00000060 | 2CFC 0314 DBF0 8D8B E1C6 572E 861F 40F5 | ,.........W...@.
00000070 | 207A 4DCC 0A86 678A 2B0B DFDF 9850 13E1 |  zM...g.+....P..
00000080 | BBB4 7005 D001 058C 1033 416E 6060 6464 | ..p......3An``dd
00000090 | A8E0 6160 3032 3555 F075 42D8 0752 02D2 | ..a`025U.uB..R..
000000A0 | DF0B D4F3 261A 62F7 4CA9 9585 3F80 F482 | ....&.b.L...?...
000000B0 | 0E2E 860C 0623 0303 4B03 1343 4B06 08CB | .....#..K..CK...
000000C0 | D4C8 02A4 4600 8A51 8002 1443 CD7D C9CC | ....F..Q...C.}..
000000D0 | C090 06B4 5D86 C102 EC86 1460 C004 B031 | ....]......`...1
000000E0 | 30F8 899A 9785 945A FA9B 1BE4 95DB DA22 | 0......Z......."
000000F0 | B46F 6184 A859 C106 7233 0B27 4CFC 07D0 | .oa..Y..r3.'L...
00000100 | 6F4C 0C1F 190B A07E 06B9 AB1E 6885 737E | oL.....~....h.s~
00000110 | 6E41 6949 6A91 5F62 6E2A BA53 7080 C462 | nAiIj._bn*.Sp..b
00000120 | 1044 1304 009B 9C52 14                  | .D.....R.

There was an outbound traffic produced on port 0:

00000000 | 5941 4E47 5A2D 0100 00B8 0100 0078 9C4B | YANGZ-.......x.K
00000010 | 0B5F 5A38 8781 8181 1588 1981 5883 8B81 | ._Z8........X...
00000020 | 8109 4807 A716 9565 26A7 2A04 2426 672B | ..H....e&.*.$&g+
00000030 | 1831 306C 9ED7 5003 1466 28E5 6EAC D90E | .10l..P..f(.n...
00000040 | 6298 4F61 8081 2751 2BC0 F409 D689 3512 | b.Oa..'Q+.....5.
00000050 | AFB9 1936 44AF 6008 04B2 57B0 7332 E402 | ...6D.`...W.s2..
00000060 | E9C5 622B 0BFF 00C5 367C E362 B8F1 958B | ..b+....6|.b....
00000070 | E107 503D 885E 13B3 82E1 99E2 CAC2 F737 | ..P=.^.........7
00000080 | 26D4 44F8 2E2D 5C01 7440 0123 C44C 901B | &.D..-\.t@.#.L..
00000090 | 1818 1919 2A78 1818 8C4C 4D15 7C9D E0D6 | ....*x...LM.|...
000000A0 | 81DD 09D2 DF0B D4F3 261A 62F7 4CA9 9585 | ........&.b.L...
000000B0 | 3F80 F482 0E2E 860C 0623 0303 4B03 1343 | ?........#..K..C
000000C0 | 4B06 08CB D4C8 02A4 4600 8A51 8002 1443 | K.......F..Q...C
000000D0 | CD7D C9CC C090 06B4 5D86 C102 EC86 1460 | .}......]......`
000000E0 | C004 B031 30CC 1335 2F0B 29B5 F437 37C8 | ...10..5/.)..77.
000000F0 | 2BB7 B545 687F C304 51B3 870D E466 162E | +..Eh...Q....f..
00000100 | 98F8 0FA0 DF98 183E B217 40FD 0C72 573D | .......>..@..rW=
00000110 | D00A E7FC DC82 D292 D422 BFC4 DC54 74A7 | ........."...Tt.
00000120 | E000 89C5 2088 2608 00B2 ED53 37        | .... .&....S7

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.