Trojan.DownLoader35.62685

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /IM ProcessHacker.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM ProjectTitan.exe
'%WINDIR%\syswow64\taskkill.exe' /IM conhost.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM Auxillary.exe
'%WINDIR%\syswow64\taskkill.exe' /IM Window-Title-Changer.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM TP3Helper.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM tp3helper.dat
'%WINDIR%\syswow64\taskkill.exe' /F /IM androidemulator.exe
'%WINDIR%\syswow64\taskkill.exe' /IM ProcessHacker
'%WINDIR%\syswow64\taskkill.exe' /IM Procmon.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM QMEmulatorService.exe
'%WINDIR%\syswow64\taskkill.exe' /IM Procmon
'%WINDIR%\syswow64\taskkill.exe' /F /IM RuntimeBroker.exe
'%WINDIR%\syswow64\taskkill.exe' /F /im adb.exe
'%WINDIR%\syswow64\taskkill.exe' /F /im GameLoader.exe
'%WINDIR%\syswow64\taskkill.exe' /F /im TBSWebRenderer.exe
'%WINDIR%\syswow64\taskkill.exe' /F /im AppMarket.exe
'%WINDIR%\syswow64\net.exe' stop QMEmulatorService
'%WINDIR%\syswow64\taskkill.exe' /IM taskmgr.exe
'%WINDIR%\syswow64\net.exe' stop aow_drv
'%WINDIR%\syswow64\taskkill.exe' /F /IM TitanService.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im aow_exe.exe
'%WINDIR%\syswow64\taskkill.exe' /IM adb.exe /F
'%WINDIR%\syswow64\taskkill.exe' /f /im dnplayer.exe /F
'%WINDIR%\syswow64\taskkill.exe' /f /im ld.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM peview.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im conime.exe
'%WINDIR%\syswow64\taskkill.exe' /IM NLClientApp.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im QQDL.EXE
'%WINDIR%\syswow64\taskkill.exe' /IM HTTPDebuggerUI.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im qqlogin.exe
'%WINDIR%\syswow64\taskkill.exe' /IM Fiddler.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im dnfchina.exe
'%WINDIR%\syswow64\taskkill.exe' /IM procexp.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im dnfchinatest.exe
'%WINDIR%\syswow64\taskkill.exe' /IM procexp64.exe
'%WINDIR%\syswow64\taskkill.exe' /IM procexp64a.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
'%WINDIR%\syswow64\taskkill.exe' /IM dnSpy.exe
'%WINDIR%\syswow64\taskkill.exe' /IM dnSpy.Console.exe
'%WINDIR%\syswow64\net.exe' stop Tensafe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'Regmonclass', WindowName: ''
ClassName: 'Filemonclass', WindowName: ''

Сетевая активность

TCP

'ap#.auth.gg':443

UDP

DNS ASK ap#.auth.gg

Другое

Ищет следующие окна

ClassName: '4823-00000029' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c taskkill /IM adb.exe /F& taskkill /f /im dnplayer.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im conime.exe& taskkill /f /im QQDL.EX...' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /IM ProcessHacker.exe& taskkill /IM peview.exe& taskkill /IM NLClientApp.exe& taskkill /IM HTTPDebuggerUI.exe& taskkill /IM Fiddler.exe& taskkill /IM procexp.exe& taskkill /IM proce...' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c taskkill /IM adb.exe /F& taskkill /f /im dnplayer.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im ld.exe /F& taskkill /f /im conime.exe& taskkill /f /im QQDL.EX...
'%WINDIR%\syswow64\cmd.exe' /c taskkill /IM ProcessHacker.exe& taskkill /IM peview.exe& taskkill /IM NLClientApp.exe& taskkill /IM HTTPDebuggerUI.exe& taskkill /IM Fiddler.exe& taskkill /IM procexp.exe& taskkill /IM proce...
'%WINDIR%\syswow64\arp.exe' -a
'%WINDIR%\syswow64\net1.exe' stop QMEmulatorService
'%WINDIR%\syswow64\net1.exe' stop aow_drv
'%WINDIR%\syswow64\net1.exe' stop Tensafe