TROJ_INCURE.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

File Size: 21,735,769 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 11 Apr 2014

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

%System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\Agent
%User Temp%\nsz6.tmp
%System%\Infosecure
%System%\Infosecure\File
%System%\Infosecure\Count
%System%\Infosecure\Log
%System%\Infosecure\Netinfo
%System%\Infosecure\Netinfo\Log
%System%\Infosecure\Netinfo\count
%System%\Infosecure\Netinfo\Ftp
%System%\Infosecure\Netinfo\Ftp\Temp
%System%\Infosecure\NetInfo
%System%\Infosecure\NetInfo\Log
%System%\Infosecure\NetInfo\Count
%System%\Infosecure\NetInfo\Ftp
%System%\Infosecure\NetInfo\Ftp\Temp
%System%\Infosecure\NetInfo\Bin
%System%\Infosecure\NetInfo\Config
%System%\Infosecure\NetInfo\driver
%System%\Infosecure\NetInfo\driver\CISCO350
%System%\Infosecure\NetInfo\driver\CISCO350\2K
%System%\Infosecure\NetInfo\driver\CISCO350\XP

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This Trojan registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\zzz_1_00_00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\zzz_1_00_11

Other System Modifications

This Trojan deletes the following files:

%User Temp%\nsl1.tmp
%User Temp%\nsz6.tmp
%System%\Infosecure\Svc.exe
%System Root%\uninstall.exe
%System%\uninstall.exe
%System%\AD_19.dat
%System%\Infosecure\Netinfo\Bin\DsClientNetInfo.exe
%System%\INFOSECURE\NETINFO\Config\NARules.ldb
%System%\infosecure\test.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Ms IAP Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Ms IAP Service

HKEY_LOCAL_MACHINE\Software\DsClientRSvr

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion
Agent = "install"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
DisplayName = "Ms IAP Service"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
ImagePath = "%System%\Infosecure\DsClientSvc.exe"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
Type = "11"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
3474:TCP = "3474:TCP:*:Enabled:DsClientRSvr"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\GloballyOpenPorts\
List
3474:TCP = "3474:TCP:*:Enabled:DsClientRSvr"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Jet\4.0\Engines
SandBoxMode = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Ms IAP Service
ImagePath = "%System%\infosecure\DsClientSvc.exe"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\InprocServer32
ThreadingModel = "Apartment"