WORM_IRCBOT.KNG

October 09, 2012

Analysis by: kathleenno

Modified by: Kathleen Notario

ALIASES:

W32.IRCBot (Symantec); Backdoor:Win32/Lamin.A (Microsoft); Trojan.Win32.Obfuscated.whl (Kaspersky); Generic.dx (Mcafee); W32/IRCBot-ADJ (Sophos); W32/IrcBot.CKB.worm (Panda)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It bears the file icons of certain applications to avoid easy detection and consequent removal.

It connects to Internet Relay Chat (IRC) servers.

TECHNICAL DETAILS

File Size: 704,000 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 30 Sep 2010

Payload: Compromises system security, Connects to URLs/IPs

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following non-malicious files:

%Program Files%\Microsoft Office\OFFICE11\control.ini
%Program Files%\Microsoft Office\OFFICE11\Drvics32.dll
%Program Files%\Microsoft Office\OFFICE11\hjwgsd.dll
%Program Files%\Microsoft Office\OFFICE11\jwiegh.dll
%Program Files%\Microsoft Office\OFFICE11\PUB60SP.mrc
%Program Files%\Microsoft Office\OFFICE11\remote.ini
%Program Files%\Microsoft Office\OFFICE11\ruimsbbe.dll
%Program Files%\Microsoft Office\OFFICE11\smss.exe
%Program Files%\Microsoft Office\OFFICE11\yofc.dll

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following copies of itself into the affected system:

%User Startup%\Adobe Gamma Loader.com
%Program Files%\Microsoft Office\OFFICE11\services.exe
%Program Files%\Microsoft Office\OFFICE11\ WINWORD.EXE

It bears the file icons of the following applications:

Microsoft Word

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "%Program Files%\Microsoft Office\OFFICE11\services.exe"

Other System Modifications

This worm adds the following registry entries:

HKEY_CLASSES_ROOT\exefile
NeverShowExt =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirstRunDisabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Acha.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AmyMastura.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
BabyRina.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
cscript.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
csrsz.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
lsasc.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
registry.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SMSSS.exe
Debugger = "cmd.exe /c del"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wscript.exe
Debugger = "rundll32.exe"

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinDefend

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"