ThreatExpert Report: BackDoor-CKB.dr, Backdoor:Win32/PcClient.AI, Trojan.Crypt, Mal/Behav-160

Submission Summary:

Submission details:

Submission received: 8 June 2009, 03:56:13
Processing time: 6 min 3 sec
Submitted sample:

File MD5: 0xFD689382D5E2A4A7FE457A109F571D24
File SHA-1: 0xE0031C3495A63A72DABC048666CAA8C5502B3008
Filesize: 64,437 bytes
Alias:

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\0004d30d.sys	1 bytes	MD5: 0xCFCD208495D565EF66E7DFF9F98764DA SHA-1: 0xB6589FC6AB0DC82CF12099D1C2D40AB994E8410C	(not available)
2	%System%\degvrn.DLL	44,680 bytes	MD5: 0x52616477FBE346E0B9B82FB5CB1D9219 SHA-1: 0xC70050D7DCC5CAD04A030B7600E225614FA70C10	Mal/Behav-160 [Sophos] packed with PE_Patch.PECompact [Kaspersky Lab]
3	[file and pathname of the sample #1]	64,437 bytes	MD5: 0xFD689382D5E2A4A7FE457A109F571D24 SHA-1: 0xE0031C3495A63A72DABC048666CAA8C5502B3008	BackDoor-CKB.dr [McAfee] Backdoor:Win32/PcClient.AI [Microsoft] Trojan.Crypt [Ikarus]

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	25,088 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
degvrn.dll	%System%\degvrn.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x820000 - 0x83D000

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
WinErp	Windows System Event reporting	"Starting"	%System%\svchost.exe -KWinErp

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinErp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinErp\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinErp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinErp\Parameters

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

WinErp = "WinErp"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinErp"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP\0000]

Service = "WinErp"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Windows System Event reporting"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINERP]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Enum]

0 = "Root\LEGACY_WINERP\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp\Parameters]

ServiceDll = "%System%\degvrn.DLL"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinErp]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -KWinErp"
DisplayName = "Windows System Event reporting"
ObjectName = "LocalSystem"
Description = "Windows System Event reporting for services and applictions running log environments."

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinErp\Parameters]

ServiceDll = "%System%\degvrn.DLL"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinErp]

Start = 0x00000002
Description = "Windows System Event reporting for services and applictions running log environments."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinErp"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP\0000]

Service = "WinErp"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Windows System Event reporting"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINERP]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Enum]

0 = "Root\LEGACY_WINERP\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp\Parameters]

ServiceDll = "%System%\degvrn.DLL"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinErp]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -KWinErp"
DisplayName = "Windows System Event reporting"
ObjectName = "LocalSystem"
Description = "Windows System Event reporting for services and applictions running log environments."

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinErp\Parameters]

ServiceDll = "%System%\degvrn.DLL"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinErp]

Start = 0x00000002
Description = "Windows System Event reporting for services and applictions running log environments."

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) = 0x0000000C

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

DBWinMutex

The following Host Name was requested from a host database:

m28.3322.org

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
m28.3322.org	127

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 127:

00000000 | 504F 5354 202F 3230 3039 3036 3038 2F30 | POST /20090608/0
00000010 | 3435 3634 302F 3331 3034 3337 2E6A 7370 | 45640/310437.jsp
00000020 | 2048 5454 502F 312E 310D 0A41 6363 6570 |  HTTP/1.1..Accep
00000030 | 743A 202A 2F2A 0D0A 5573 6572 2D41 6765 | t: */*..User-Age
00000040 | 6E74 3A20 4D6F 7A69 6C6C 612F 342E 3020 | nt: Mozilla/4.0
00000050 | 2863 6F6D 7061 7469 626C 653B 204D 5349 | (compatible; MSI
00000060 | 4520 372E 303B 2057 696E 646F 7773 204E | E 7.0; Windows N
00000070 | 5420 352E 323B 202E 4E45 5420 434C 5220 | T 5.2; .NET CLR
00000080 | 312E 312E 3433 3232 3B20 2E4E 4554 2043 | 1.1.4322; .NET C
00000090 | 4C52 2032 2E30 2E35 3037 3237 3B20 496E | LR 2.0.50727; In
000000A0 | 666F 5061 7468 2E31 290D 0A48 6F73 743A | foPath.1)..Host:
000000B0 | 206D 3238 2E33 3332 322E 6F72 673A 3132 |  m28.3322.org:12
000000C0 | 370D 0A43 6F6E 7465 6E74 2D4C 656E 6774 | 7..Content-Lengt
000000D0 | 683A 2034 3634 0D0A 436F 6E6E 6563 6469 | h: 464..Connecdi
000000E0 | 6F6E 3A20 4B65 6570 2D41 6C69 7665 0D0A | on: Keep-Alive..
000000F0 | 4361 6368 652D 436F 6E74 726F 6C3A 206E | Cache-Control: n
00000100 | 6F2D 6361 6368 650D 0A0D 0A55 0A15 156D | o-cache....U...m
00000110 | 1915 1515 D5E2 1AF1 1115 15A0 1415 1515 | ................
00000120 | 1515 1517 1515 1514 1515 15E5 1615 15F8 | ................
00000130 | D1DF 46BA CB9B 51A8 9D06 37B0 3C51 8715 | ..F...Q...7.<Q..
00000140 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000150 | 1515 1525 2C25 2325 2415 1515 1515 1515 | ...%,%#%$.......
00000160 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000170 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000180 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000190 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000001A0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000001B0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000001C0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000001D0 | 1515 1556 5A58 4540 4150 475B 5458 5015 | ...VZXE@APG[TXP.
000001E0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000001F0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000200 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000210 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000220 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000230 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000240 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000250 | 1515 152D 252D 2515 1515 1515 1515 1515 | ...-%-%.........
00000260 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000270 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000280 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
00000290 | 1515 15AD CAA9 A3C2 BDA5 F34E 2725 252D | ...........N'%%-
000002A0 | 2523 2420 4815 1515 1515 1515 1515 1515 | %#$ H...........
000002B0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000002C0 | 1515 1515 1515 1515 1515 1515 1515 1515 | ................
000002D0 | 1515 1515 1515 1515 1515 15             | ...........

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.