TROJ_LUKICSEL.H

This Trojan is dropped by other malware as a file with a certain file name.

It tries to open threads in svchost.exe that may be create by other component malware.

It tries to find the file %System%\crt.dll, which may be a component file.

This Trojan may be dropped by other malware. It arrives as a component bundled with malware/grayware packages.

Arrival Details

This Trojan may be dropped by other malware.

It arrives as a component bundled with malware/grayware packages.

Installation

This Trojan is injected into the following processes running in memory:

• Winlogon.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
DllName = "kbupdate.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
Startup = "WinlogonStartupEvent"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
Logoff = "WinlogonLogoffEvent"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
Shutdown = "WinlogonLogoffEvent"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
Asynchronous = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\kbupdate
Impersonate = "0"

NOTES:
This Trojan is dropped by other malware as %System%\kbupdate.dll. The Trojan may only be dropped as %System%\kbupdate.dll. It tries to open threads in svchost.exe that may be create by other component malware. It tries to find the file %System%\crt.dll, which may be a component file.