BKDR_CINDYC.D

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_MDROP.TOL

Installation

This backdoor drops the following files:

• %User Profile%\Local Settings\help.dll - also detected as BKDR_CINDYC.D
• %User Profile%\Local Settings\tmp.bak - also detected as BKDR_CINDYC.D
• %User Temp%\~ATEMP.CPL - also detected as BKDR_CINDYC.D
• %User Temp%\~ATEMP.CPL.bak - also detected as BKDR_CINDYC.D
• %User Temp%\help32.dll - also detected as BKDR_CINDYC.D

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following processes:

• svchost.exe

Its DLL component is injected to the following process(es):

• svchost.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• IMSCMig

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
explorer\run
IMSCMig = "Rundll32.EXE %User Profile%\Local Settings\help.dll,NotifyLogonUser"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\ts

HKEY_CURRENT_USER\Software\ts\
explorer

HKEY_CURRENT_USER\Software\ts\
explorer\run

HKEY_CURRENT_USER\Software\ts\
NonEnum

HKEY_CURRENT_USER\Software\ts\
Ratings

HKEY_CURRENT_USER\Software\ts\
system

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
explorer\run

It adds the following registry entries:

HKEY_CURRENT_USER\Software
{random number} = "F0F996E3"

HKEY_CURRENT_USER\Software
key = "1"

HKEY_CURRENT_USER\Software\ts\
explorer\run
IMSCMig = "Rundll32.EXE %User Profile%\Local Settings\help.dll,NotifyLogonUser"

HKEY_CURRENT_USER\Software\ts\
NonEnum
{0DF44EAA-FF21-4412-828E-260A8728E7F1} = "20"

HKEY_CURRENT_USER\Software\ts\
NonEnum
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = "40000021"

HKEY_CURRENT_USER\Software\ts\
NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = "1"

HKEY_CURRENT_USER\Software\ts\
system
dontdisplaylastusername = "0"

HKEY_CURRENT_USER\Software\ts\
system
legalnoticecaption = ""

HKEY_CURRENT_USER\Software\ts\
system
legalnoticetext = ""

HKEY_CURRENT_USER\Software\ts\
system
shutdownwithoutlogon = "1"

HKEY_CURRENT_USER\Software\ts\
system
undockwithoutlogon = "1"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Capture screen, audio, and webcam
• Download files
• Get drive information
• Get system information
• List active ports
• Lock workstation
• Log keystrokes
• Log off user
• Monitor browsing habits
• Manage files and folders
• Manage open windows
• Manage passwords
• Manage registry, processes, services, devices, and installed applications
• Perform multiple simultaneous transfers
• Perform remote shell
• Relay server
• Restart/Reboot system
• Share servers
• Update, restart, terminates itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}in.{BLOCKED}p.net

It posts the following information to its command and control (C&C) server:

• Computer name
• Drive information
• Operating system information
• Processor speed
• RAM Information
• Saved email password
• Saved email address
• Service pack information
• System settings
• User name and cached password

NOTES:

This backdoor checks for the existence of the following processes:

• 360tray.exe
• avgtray.exe
• avmailc.exe
• bdagent.exe
• ksafesvc.exe
• kvmonxp.exe
• ravmond.exe

If one of these processes is found, it will rename the dropped DLL file to avoid detection.