ThreatExpert Report: Trojan.Win32.Patched.la, TrojanDownloader:Win32/Begseabug.A..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 23 October 2012, 02:56:26
Processing time: 8 min 16 sec
Submitted sample:

File MD5: 0xF3E69B278864649A025108507818CA68
File SHA-1: 0xBEEBBCC6579F26D9A556E5BBAC3D1D730A440DA4
Filesize: 221,696 bytes
Alias:

Trojan.Win32.Patched.la [Kaspersky Lab]
TrojanDownloader:Win32/Begseabug.A [Microsoft]
Trojan.Win32.Swisyn [Ikarus]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\13.tmp %Temp%\14.tmp %Temp%\15.tmp %Temp%\16.tmp %Temp%\17.tmp %Temp%\18.tmp %Temp%\19.tmp %Temp%\1A.tmp %Temp%\1B.tmp %Temp%\1C.tmp %Temp%\1D.tmp %Temp%\1E.tmp %Temp%\1F.tmp %Temp%\2.tmp %Temp%\20.tmp %Temp%\21.tmp %Temp%\22.tmp %Temp%\23.tmp %Temp%\24.tmp %Temp%\25.tmp %Temp%\26.tmp %Temp%\27.tmp %Temp%\28.tmp %Temp%\29.tmp %Temp%\2A.tmp %Temp%\2B.tmp %Temp%\2C.tmp %Temp%\2D.tmp %Temp%\2E.tmp %Temp%\3.tmp %Temp%\30.tmp %Temp%\31.tmp %Temp%\32.tmp %Temp%\33.tmp %Temp%\34.tmp %Temp%\35.tmp %Temp%\36.tmp %Temp%\37.tmp %Temp%\39.tmp %Temp%\3A.tmp %Temp%\3B.tmp %Temp%\3C.tmp %Temp%\3D.tmp %Temp%\3E.tmp %Temp%\3F.tmp %Temp%\4.tmp %Temp%\40.tmp %Temp%\41.tmp %Temp%\42.tmp %Temp%\48.tmp %Temp%\49.tmp %Temp%\4A.tmp %Temp%\4B.tmp %Temp%\4C.tmp %Temp%\4D.tmp %Temp%\4E.tmp %Temp%\4F.tmp %Temp%\5.tmp %Temp%\50.tmp %Temp%\52.tmp %Temp%\53.tmp %Temp%\54.tmp %Temp%\55.tmp %Temp%\56.tmp %Temp%\57.tmp %Temp%\58.tmp %Temp%\59.tmp %Temp%\5A.tmp %Temp%\5B.tmp %Temp%\5C.tmp %Temp%\5D.tmp %Temp%\6.tmp %Temp%\7.tmp %Temp%\8.tmp %Temp%\9.tmp %Temp%\A.tmp %Temp%\B.tmp %Temp%\C.tmp %Temp%\D.tmp %Temp%\E.tmp %Temp%\F.tmp	656,384 bytes	MD5: 0xC0823FC5469663BA63E7DB88F9919D70 SHA-1: 0xD9BD35CC4B1F26D788C91E2DB1DCC3B47665A064	(not available)
2	%System%\dvec.dll %System%\ouewt.dll %System%\wtlku.dll	22,528 bytes	MD5: 0xB5DC82E79797A95985281FC603BC1967 SHA-1: 0xEA60D6BEA59A4E8FFA16E4DE08C3547D364F40B1	Trojan.Gen [Symantec] Trojan.Win32.Agent2.cvsv [Kaspersky Lab] Generic Downloader.x!fiq [McAfee] Mal/Geral-A [Sophos] Worm:Win32/Citeary.D [Microsoft] Trojan.Win32.Agent2 [Ikarus] Win-Trojan/Agent2.22528.AM [AhnLab]
3	%System%\etlb.dll %System%\sjkus.dll %System%\xjiiu.dll	77,824 bytes	MD5: 0xD8825D71F4F42ED2FB9832BC087B6B71 SHA-1: 0x39C76E2C9745B295810D13D9C5408206A93974DE	Trojan.Gen [Symantec] Trojan.Win32.Agent.fdsi [Kaspersky Lab] Generic.bfr!fa [McAfee] Mal/Geral-A [Sophos] Worm:Win32/Citeary.E [Microsoft] Trojan-Downloader.Win32.Geral [Ikarus] Win-Trojan/Agent.77824.AEM [AhnLab]
4	[file and pathname of the sample #1]	71,680 bytes	MD5: 0x44862FB9B9EE8CDF33DE2D408D426C17 SHA-1: 0xE6EF24509DFA0A8754B15FB0344FA4AA04C618C8	(not available)
5	[file and pathname of the sample #1]t	221,696 bytes	MD5: 0xF3E69B278864649A025108507818CA68 SHA-1: 0xBEEBBCC6579F26D9A556E5BBAC3D1D730A440DA4	Trojan.Win32.Patched.la [Kaspersky Lab] TrojanDownloader:Win32/Begseabug.A [Microsoft] Trojan.Win32.Swisyn [Ikarus]
6	%System%\system.exe	145,408 bytes	MD5: 0x6E3C223CFAFE2ADB4C87EE6C78583E10 SHA-1: 0xBC4F7F1FDA84A76B9EF4CB339A5945CBD34B1E91	W32.SillyDC [Symantec] Trojan.Win32.Scar.cthx [Kaspersky Lab] Generic.dx!tvq [McAfee] Worm:Win32/Citeary.D [Microsoft] Worm.Win32.Citeary [Ikarus]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
system.exe	%System%\system.exe	155,648 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	81,920 bytes
[generic host process]	[generic host process filename]	45,056 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
dvec.dll	%System%\dvec.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x390000 - 0x39A000
ouewt.dll	%System%\ouewt.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x390000 - 0x39A000
wtlku.dll	%System%\wtlku.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x390000 - 0x39A000

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
PolicyAgent	IPSEC Services	"Stopped"	%System%\lsass.exe

Registry Modifications

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

system = "%System%\system.exe"

so that system.exe runs every time Windows starts

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

SeBebugPrivilege

The following Host Names were requested from a host database:

tsa13.t12hg.com
192.5.5.241

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.