BKDR_MIRAS.B

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi
DisplayName = "WMI service provider"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi\Parameters
ServiceDll = "C:\WINDOWS\System32\wbem\raswmi.dll"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi\Enum

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\raswmi\Security

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{Default values} raswmi"

(Note: The default value data of the said registry entry is {Default values}.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Retrieve username of currently logged on Remote Desktop user and impersonates it
• Enumerate all logical drives
• Get logical drive’s drive type and disk space
• Enumerate files and folders
• Get file’s name, size, attributes and date/time of last modification.
• Delete files and folders
• Copy files and folders
• Read files
• Download files
• Upload files
• Execute files
• Enumerate processes on the current Remote Desktop Session Host server
• Get process’ creation, exit, kernel and user time
• Enumerate all modules of a process
• Create and terminate processes
• Perform remote shell
• Gets the following system information using systeminfo command:
  • Host Name
  • OS Name
  • OS Version
  • OS Manufacturer
  • OS Configuration
  • OS Build Type
  • Registered Owner
  • Registered Organization
  • Product ID
  • Original Install Date
  • System Boot Time
  • System Manufacturer
  • System Model
  • System Type
  • Processor information (processor count and model)
  • BIOS Version
  • Windows Directory location
  • System Directory location
  • Boot Device
  • System Locale
  • Input Locale
  • Time Zone
  • Total Physical Memory
  • Available Physical Memory
  • Virtual Memory information (max, available and in use size)
  • Page File Location
  • Domain
  • Logon Server
  • Hotfixes installed
  • Network Cards installed
  • Connection Name
  • DHCP Enabled
  • DHCP Server
  • IP addresses

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.210.49

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• http://65.55.58.199