Upatre Zbot [email protected] Alina-FAX lojasdeouro.com

Trojan.Downloader.Upatre Email Campaign
Reported by neonprimetime security
http://neonprimetime.blogspot.com

*****
From:	[email protected]
Subject(s):
     Alina-FAX pNxXCD_864975
     Alina-FAX VxBElw_165562
     Alina-FAX ydkQrc_045052
     cGKZn7_902344
     7wLntD_102365
     Alina-FAX k6vw9d_163911
     Alina-FAX Oe9BXH_737904
     Alina-FAX T9wKzF_930430
     Alina-FAX TgyhYW_268841
     Alina-FAX 3E4ymh_658825
     Alina-FAX 9tcT0i_490824
     Alina-FAX oW39tV_753875
Attachments(s):
    pNxXCD_864975.zip
    VxBElw_165562.zip
    ydkQrc_045052.zip
    cGKZn7_902344.zip
    7wLntD_102365.zip
    k6vw9d_163911.zip
    Oe9BXH_737904.zip
    T9wKzF_930430.zip
    TgyhYW_268841.zip
    3E4ymh_658825.zip
    9tcT0i_490824.zip
    oW39tV_753875.zip

*****
Matches:

Trojan.Zbot

Suspicious.JIT.a


BLACKLIST User-Agent known malicious user-agent string - Mazilla/5.0 - Win.Backdoor.Upatre (1:33207)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLACKLIST User-Agent known malicious user-agent string - Mazilla/5.0 - Win.Backdoor.Upatre"; flow:to_server,established; content:"User-Agent: Mazilla/5.0|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:33207; rev:2; )
*****

216.146.43.70
GET http://checkip.dyndns.org/
User-Agent: Mazilla/5.0::

141.105.141.87
GET http://141.105.141.87:13878/0604uk21/<REDACTED WORKSTATION NAME>/41/1/1/EMLBEMDBFGEBEI
User-Agent: Mazilla/5.0

162.252.57.88
GET http://encomiendaexpress.com/es/images/mut103.png
User-Agent: Mazilla/5.0

5.206.231.133
GET http://lojasdeouro.com/wp-includes/images/mut103.png
User-Agent: Mazilla/5.0

****
Files touched or accessed:

C:\Users\Administrator\AppData\Local\Temp\eisqwp.exe
C:\Windows\System32\WOW64LOG.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\CRTDLL.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\VERSION.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\DWMAPI.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\RICHED32.DLL
C:\Windows\SysWOW64\RPCSS.DLL
C:\Users\Administrator\AppData\Local\Temp\dmiB03A.tmp
C:\Windows\SysWOW64\cmd.exe
C:\Users\ADMINI~1\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Users\ADMINI~1\AppData\Local\Temp\IPHLPAPI.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\WINNSI.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies
C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\CRYPTSP.DLL
C:\Users\ADMINI~1\AppData\Local\Temp\RPCRTREMOTE.DLL

****
Assembly utilized:

71C9FCE1 movzx eax, ax;71C9FCE4 push eax;71C9FCE5 call 0xffffffffffff74a4;71C9FCEA push dword 0x71c9fff0;71C9FCEF mov [ebp-0x8], eax;71C9FCF2 call 0xffffffffffffcf61;71C9FCF7 push 0x11;71C9FCF9 movzx eax, ax;71C9FCFC mov esi, 0x89;71C9FD01 push esi;

****
Registries touched or accessed:

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyEnable" = 0x00000000
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyOverride"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoConfigURL"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoDetect"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"SavedLegacySettings" = 46 00 00 00 1c 00 00 00 09 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 0a 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"ProxyBypass"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"AutoDetect" = 0x00000001
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000
\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\"CachePrefix" = Cookie: