Examples of Troj/RansmMem-A include:
Example 1
File Information
- Size
- 164K
- SHA-1
- 54b7713d3ae70f8832fd531e18298a0d0110b6b1
- MD5
- d0a9455c77ed8b84912a73afeb3f09d6
- CRC-32
- c1cf5cd6
- File type
- Windows executable
- First seen
- 2007-07-30
Other vendor detection
- Avira
- TR/Dropper.Gen
Runtime Analysis
Dropped Files
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
- Size
- 5.5K
- SHA-1
- 52a701bff735e49b241a8db2685fb3c7d405fefb
- MD5
- 7fea1d29dcf1d92c8416b4658bff5c43
- CRC-32
- 0ec413ca
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-18
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
- Size
- 4.2K
- SHA-1
- 4d104ae1f6e4690f3c13db56a15bf4435004bb52
- MD5
- 1f47ffdd1df2baebcb51b3193bd580df
- CRC-32
- 9266033f
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-18
Registry Keys Created
- HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup
- BITS_metadata
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\*
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\BITS\CtlGuid
- BitNames
- LogFlagInfo LogFlagWarning LogFlagError LogFlagFunction LogFlagRefCount LogFlagSerialize LogFlagDownload LogFlagTask LogFlagLock LogFlagService LogFlagDataBytes LogFlagTransferDetails
- HKLM\SYSTEM\CurrentControlSet\Services\BITS\Enum
- NextInstance
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
- StateIndex
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\BITS
- ControlFlags
- 0x00000001
Registry Keys Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell
- Explorer.exe, C:\Documents and Settings\All Users\Application Data\luMogjcecMy
HTTP Requests
- http://b6sfdgyushiftusghfisgjfh.org/ad4/
DNS Requests
- b6sfdgyushiftusghfisgjfh.org
Example 2
File Information
- Size
- 102K
- SHA-1
- 7e9f3d62f588034f9e5a593aba46fd46937bd4f9
- MD5
- 3b9c7cb8fad1661a837fd61ac23460ea
- CRC-32
- 9fe56d2d
- File type
- Windows executable
- First seen
- 2012-11-12
Runtime Analysis
Registry Keys Created
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
- StateIndex
- 0x00000000
- HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup
- BITS_metadata
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\*
- HKLM\SYSTEM\CurrentControlSet\Services\BITS\Enum
- NextInstance
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\BITS\CtlGuid
- BitNames
- LogFlagInfo LogFlagWarning LogFlagError LogFlagFunction LogFlagRefCount LogFlagSerialize LogFlagDownload LogFlagTask LogFlagLock LogFlagService LogFlagDataBytes LogFlagTransferDetails
- HKCU\Software\Microsoft\Command Processor
- AutoRun
- "c:\Documents and Settings\test user\Local Settings\Application Data\mvdqphsiojtc.exe"
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\BITS
- ControlFlags
- 0x00000001
Registry Keys Modified
- HKLM\SYSTEM\CurrentControlSet\Services\BITS
- Start
- 0x00000002
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell
- Explorer.exe, C:\Documents and Settings\All Users\Application Data\mvdqphsiojtc
HTTP Requests
- http://urlazapurla.org/ad/
DNS Requests
Example 3
File Information
- Size
- 111K
- SHA-1
- a5ac8eecb4a9de9c7ca3accff7aa08cdb9f8fe88
- MD5
- 5c8120c6356f38b686e91b685748eccf
- CRC-32
- db1e0307
- File type
- Windows executable
- First seen
- 2013-01-02
Runtime Analysis
Copies Itself To
- C:\Documents and Settings\All Users\Application Data\_bd_uylzs.exe
- c:\Documents and Settings\test user\Local Settings\Application Data\_bd_uylzs.exe
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\mp.htm
- Size
- 2.0K
- SHA-1
- f22dd65d03a22e3059909cd46a19772aaf85c063
- MD5
- 054f759497cf251ef59d846c528e3777
- CRC-32
- ec00f23e
- File type
- Hypertext Markup Language
- First seen
- 2012-12-25
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\mp.png
- Size
- 34K
- SHA-1
- 039e615b25879433de4a263860026a922e688bef
- MD5
- ce45087616a30c06036adbe2b82d9259
- CRC-32
- 3be63d47
- File type
- PNG (Portable Network Graphics) image format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\bg2.jpg
- Size
- 121K
- SHA-1
- a5ec7a25b32e358ec58dc571b6213331a769eda3
- MD5
- 0ebf876a4efafcc00f1c02472807acd1
- CRC-32
- bcfc15bf
- File type
- JPEG Interchange Format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\button.png
- Size
- 394
- SHA-1
- 54d4b968b889f2ef50e405188e473618cf63b3e9
- MD5
- 86a1ceb76b7386c250f37ebd3cf17d16
- CRC-32
- 2521b1ba
- File type
- PNG (Portable Network Graphics) image format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\index.htm
- Size
- 2.1K
- SHA-1
- ef3411d244636ea7a90fe043cd91bf1bdc1e801c
- MD5
- e228289a334576d9b3804d0c8ac492f4
- CRC-32
- d34236b1
- File type
- Hypertext Markup Language
- First seen
- 2012-12-25
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\b3.png
- Size
- 18K
- SHA-1
- 5ca20b72ad0f92704cdc9f6cd56a635d34e17a92
- MD5
- 51e287dc43cd17920ab9b219bcb0b59d
- CRC-32
- 46651e13
- File type
- PNG (Portable Network Graphics) image format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\index2.htm
- Size
- 1.3K
- SHA-1
- 4b8dd8e332478be1d782985a89e3d2bf9247b35a
- MD5
- 76bd0725ff24041b1e3b79527e58662e
- CRC-32
- 683d8060
- File type
- Hypertext Markup Language
- First seen
- 2012-12-25
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\bg.jpg
- Size
- 139K
- SHA-1
- 6a8769cbadc779bacc6ade271998622cac8d5760
- MD5
- b044c693a828e9bacfffef8f84b1850f
- CRC-32
- 1744ffce
- File type
- JPEG Interchange Format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\img\uc.png
- Size
- 17K
- SHA-1
- d17eb8478c9bb4c23ffaebdb14412a8e20a275ac
- MD5
- 906fb90899d397e720ea485291a3db27
- CRC-32
- 2a8d3afe
- File type
- PNG (Portable Network Graphics) image format
- First seen
- 2012-11-26
- c:\Documents and Settings\test user\Local Settings\Temp\3.tmp\uc.htm
- Size
- 2.0K
- SHA-1
- bce84003dac1f9c7e62fab1df4793af727ac1c3d
- MD5
- 3962b9e60c0d5efdae0b5faf15e57ca9
- CRC-32
- ab523f0e
- File type
- Hypertext Markup Language
- First seen
- 2012-12-25
Modified Files
- %PROFILE%\Application Data\Microsoft\Internet Explorer\Desktop.htt
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013010220130103
- CacheRepair
- 0x00000000
- HKCU\Software\Microsoft
- Pool
- '?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□=□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□M□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□B□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□H□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□ [... 35893 intervening characters ...] ?□□?□□?□□?□□?□□?□□?□□?□□_□□?□□?□□?□□?□□?□□g□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□?□□
- HKCU\Software\Microsoft\Command Processor
- AutoRun
- "c:\Documents and Settings\test user\Local Settings\Application Data\_bd_uylzs.exe"
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012121720121224
- CacheRepair
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Internet Explorer\Desktop\Components
- GeneralFlags
- 0x00000004
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
- DisableTaskMgr
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell
- Explorer.exe, C:\Documents and Settings\All Users\Application Data\_bd_uylzs
HTTP Requests
- http://mgeoipdomenimages.com/ad/geo/img.png
- http://n7rhueufghe.org/ad4/
DNS Requests
- mgeoipdomenimages.com
- n7rhueufghe.org