ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 7 September 2012, 05:11:28
Processing time: 8 min 32 sec
Submitted sample:

File MD5: 0xFC6BACD3572E980B7A71035676651087
File SHA-1: 0x13FFF3CCBDD191441368B6F685949EA46E35AFDA
Filesize: 3,285,727 bytes

Summary of the findings:

What's been found	Severity Level
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\explolerte.exe	1,267,712 bytes	MD5: 0x2C299AD09BE7B98F9CEA88B5EBC4E555 SHA-1: 0x6308BE006041238C466F82B1B238B4868BDD2655	packed with ASPack [Kaspersky Lab]
2	%System%\konf.exe	451,584 bytes	MD5: 0x4E2C01620A3D3EDF7E39DD112FDC84B3 SHA-1: 0x3D2E1CDA240CD32938636B622DFF96AB5DE12608	(not available)
3	%System%\RIPCServer.dll	148,312 bytes	MD5: 0x30E269F850BAF6CA25187815912E21C5 SHA-1: 0xEB160DE97D12B4E96F350DD0D0126D41D658AFB3	(not available)
4	%System%\RWLN.dll	366,424 bytes	MD5: 0xBB1F3E716D12734D1D2D9219A3979A62 SHA-1: 0x0EF66EED2F2AE45EC2D478902833B830334109CB	(not available)
5	[file and pathname of the sample #1]	3,285,727 bytes	MD5: 0xFC6BACD3572E980B7A71035676651087 SHA-1: 0x13FFF3CCBDD191441368B6F685949EA46E35AFDA	(not available)
6	%System%\svshoct.exe	1,584,128 bytes	MD5: 0xDC4BE7205939988012DF14E0C0894B61 SHA-1: 0x1D8CF58F9936FF5F4065DC84CD10C13F0E23E923	(not available)

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
explolerte.exe	%System%\explolerte.exe	4,710,400 bytes
svshoct.exe	%System%\svshoct.exe	6,037,504 bytes
konf.exe	%System%\konf.exe	495,616 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	208,896 bytes

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
RManService	TektonIT - R-Server	"Stopped"	%System%\svshoct.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR 3.1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\RManService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RManService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RManService\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RManService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RManService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RManService\Security
HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System
HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4
HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server
HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR 3.1.0]

DisplayName = "WinRAR 3.1.0"
DisplayVersion = "3.1.0"
VersionMajor = 0x00000003
VersionMinor = 0x00000001
Publisher = "WinRAR"
DisplayIcon = "%System%\Uninstall.exe"
UninstallString = "%System%\Uninstall.exe"
InstallLocation = "%System%\"
InstallSource = "%System%\"
InstallDate = "20120907"
Language = 0x00000419
EstimatedSize = 0x00000E91
NoModify = 0x00000001
NoRepair = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN]

Asynchronous = 0x00000000
Impersonate = 0x00000000
DllName = "RWLN.dll"
Logoff = "WLEventLogoff"
Logon = "WLEventLogon"
Startup = "WLEventStartup"

so that RWLN.dll is installed as a Winlogon notification package

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RManService\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RManService]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svshoct.exe"
DisplayName = "TektonIT - R-Server"
ObjectName = "LocalSystem"
Description = "Allows Remote Manipulator System users to connect to this machine."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RManService\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RManService]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svshoct.exe"
DisplayName = "TektonIT - R-Server"
ObjectName = "LocalSystem"
Description = "Allows Remote Manipulator System users to connect to this machine."

[HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters]

notification = FF FE 3C 00 3F 00 78 00 6D 00 6C 00 20 00 76 00 65 00 72 00 73 00 69 00 6F 00 6E 00 3D 00 22 00 31 00 2E 00 30 00 22 00 20 00 65 00 6E 00 63 00 6F 00 64 00 69 00 6E 00 67 00 3D 00 22 00 55 00 54 00 46 00 2D 00 31 00 36 00 22 00 3F 00 3E 00 0D 00 0A 0
Options = 54 50 46 30 11 54 52 4F 4D 53 65 72 76 65 72 4F 70 74 69 6F 6E 73 00 09 55 73 65 4E 54 41 75 74 68 08 0D 53 65 63 75 72 69 74 79 4C 65 76 65 6C 02 03 04 50 6F 72 74 03 12 16 14 45 6E 61 62 6C 65 4F 76 65 72 6C 61 79 43 61 70 74 75 72 65 08 0C 53 68 6
FUSClientPath = "%System%\explolerte.exe"
CalendarRecordSettings = FF FE 3C 00 3F 00 78 00 6D 00 6C 00 20 00 76 00 65 00 72 00 73 00 69 00 6F 00 6E 00 3D 00 22 00 31 00 2E 00 30 00 22 00 20 00 65 00 6E 00 63 00 6F 00 64 00 69 00 6E 00 67 00 3D 00 22 00 55 00 54 00 46 00 2D 00 31 00 36 00 22 00 3F 00 3E 00 0D 00 0A 0

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	France

To mark the presence in the system, the following Mutex objects were created:

MutexNPA_UnitVersioning_1252
MutexNPA_UnitVersioning_1272
MutexNPA_UnitVersioning_1336
MutexNPA_UnitVersioning_1372
MutexNPA_UnitVersioning_1492
MutexNPA_UnitVersioning_1916
MutexNPA_UnitVersioning_228
MutexNPA_UnitVersioning_240
MutexNPA_UnitVersioning_424
Local\RManFUSTray
MutexNPA_UnitVersioning_748

The following Host Name was requested from a host database:

rmansys.ru

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.