kor.exe分析 by 零度x[LSG]

零度x

能有个介绍说明就好了。
都不知道这个病毒有什么行为特征
gxwtk 发表于 2010-9-14 14:32

   
病毒分析

(1) 病毒打开记事本程序，查找其窗口。若存在则发送关闭命令，以此检验系统运行环境是否正常。
(2) 调用命令行，禁用ESET NOD32的服务项，并结束相关进程：
“cmd /c sc config ekrn start= disabled”
“cmd.exe /c taskkill.exe /im ekrn.exe /f”
“cmd.exe /c taskkill.exe /im egui.exe /f”
(3) 获取系统路径，创建文件：%SystemRoot%\ee3402343t.dll（随机命名）。成功后创建进程，调用rundll32.exe以testall为参数来加载该动态链接库文件。
(4) %SystemRoot%\ee3402343t.dll获取自身自身权限信息，并将自身权限提升为SeDebugPrivilege权限。
(5) 调用sfc_os.dll库中的五号函数，解除Windows系统保护。成功后替换%SystemRoot%\system32\drivers\路径下的正常系统驱动文件AsyncMac.sys和aec.sys
(6)%SystemRoot%\system32\drivers\aec.sys恢复SSDT来解除安全软件建立的系统钩子。%SystemRoot%\system32\drivers\AsyncMac.sys则用来从驱动层结束安全软件进程。
(7)查找大量安全软件进程，一旦发现则立即结束。完成后建立所有查找的安全软件的映像劫持。查找的安全软件有：“360delays.exe”“KSWebShield.exe”“rssafety.exe”“LiveUpdate360.exe”“MPMon.exe”“MPSVC2.exe”“RegGuide.exe”“rfwsrv.exe”“DrUpdate.exe”“QQDoctorRtp.exe”“KWatch.exe”“Uplive.exe”“KAVStart.exe”“udaterui.exe”“McTray.exe”“SHSTAT.exe”“ccSvcHst.exe”“xcommsvr.exe”“vsserv.exe”“livesrv.exe”“bdagent.exe”“mcinsupd.exe”“mcshell.exe”“Framewor.exe”“kService.exe”“vstskmgr.exe”“mcagent.exe”“mcnasvc.exe”“mcmscsvc.exe”“mcsysmon.exe”“mfevtps.exe”“mcupdmgr.exe”“vptray.exe”“ccapp.exe”“rtvscan.exe”“defwatch.exe”“ccEvtMgr.exe”“ccSetMgr.exe”“KVSrvXP.exe”“KPFW32.exe”“engineserver.exe”“KavStart.exe”“kmailmon.exe”“KPfwSvc.exe”“KISSvc.exe”“MPSVC1.exe”“MPSVC.exe”“MpfSrv.exe”“naPrdMgr.exe”“rsnetsvr.exe”“mcshield.exe”“McProxy.exe”“QQDoctor.exe”“AgentSvr.exe”“RavScanFrm.exe”“RsTray.exe”“RavStub.exe”“CCenter.exe”“RavTask.exe”“RavMonD.exe”“RavMon.exe”“egui.exe”“mfeann.exe”“RsAgent.exe”“ekrn.exe”“antiarp.exe”“360tray.exe”“360Safebox.exe”“safeboxTray.exe”“avp.exe”
对应的映像劫持路径为：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
8) 删除所有开机启动项，
(9) 病毒源程序等待进程执行，执行完毕后删除%SystemRoot%\ee3402343t.dll文件
(10)创建线程，获取本地磁盘盘符并查看磁盘属性，发现本地磁盘或可移动存储器则创建文件夹X:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\（X为磁盘盘符）并伪装成回收站，属性为只读系统隐藏。完成后将自身以kav32.exe为名称复制到该目录下。同时在磁盘根目录下创建X:\AUTORUN.INF（X为磁盘盘符）, 属性为只读系统隐藏，使得用户一旦打开对应磁盘，系统便会自动运行病毒程序。
(11) 病毒调用命令行关闭Windows安全控制中心和Intemet连接共享和防火墙服务。对应命令为：
“cmd /c net stop wscsvc”
“cmd /c net stop SharedAccess”
“cmd /c sc config sharedaccess start= disabled”
(12) 病毒创建文件%SystemRoot%\extext11607390t.exe（随机命名），创建成功后运行该程序。
(13) extext11607390t.exe创建名为“XETTETT......”的互斥体以免重复运行。提升自身权限，将%SystemRoot%\system32\scvhost.exe设为开机启动项。对应注册表值为：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
名称：RsTray
数据：C:\WINDOWS\system32\scvhost.exe
(14) 创建线程，从指定网址下载文档替换%SystemRoot%\system32\drivers\etc\hosts文件，用以屏蔽大量安全软件网址。
(15) 创建线程，连接黑客指定网站，并将用户系统版本网卡MAC地址等信息发送到该网站数据库中。
(16) 访问指定网址，下载大量病毒程序并运行。
(17) 病毒源程序获取系统路径，创建驱动文件%SystemRoot%\system32\drivers\pcidump.sys，完成后将其加载为服务项。将extext11607390t.exe的地址写入%SystemRoot%\system32\userinit.exe文件的地址空间，感染userinit.exe文件。之后，删除pcidump.sys和对应服务项
(18) 病毒将自身复制为%SystemRoot%\system32\scvhost.exe
(19) 病毒在自己所在路径下创建批处理文件X:\_temp.bat（X为病毒源程序所在路径），完成后运行该批处理删除病毒源程序和批处理自身。

病毒创建文件：

%SystemRoot%\ee3402343t.dll（随机命名）
%SystemRoot%\system32\drivers\aec.sys
%SystemRoot%\system32\drivers\AsyncMac.sys
X:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe（X为磁盘盘符）
X:\AUTORUN.INF（X为磁盘盘符）
%SystemRoot%\extext11607390t.exe（随机命名）
%SystemRoot%\system32\drivers\etc\hosts
%SystemRoot%\system32\drivers\pcidump.sys
%SystemRoot%\system32\scvhost.exe
X:\_temp.bat（X为病毒源程序所在路径）

病毒删除文件：

%SystemRoot%\ee3402343t.dll（随机命名）
%SystemRoot%\system32\drivers\aec.sys
%SystemRoot%\system32\drivers\AsyncMac.sys
%SystemRoot%\system32\drivers\pcidump.sys
X:\_temp.bat（X为病毒源程序所在路径）

病毒创建注册表：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aec
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcidump
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antiarp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsScanFrm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McProxy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpfSrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KavStart.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\engineserver.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSetMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccEvtMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcinsupd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHSTAT.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udaterui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Uplive.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctorRtp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegGuide.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSWebShield.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
名称：RsTray
数据：C:\WINDOWS\system32\scvhost.exe

病毒删除注册表：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aec
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcidump
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\（被清空）

病毒访问网络：

http://vv.kk***s.info:27788/qvod/host.txt
http://tj19.x9***s.com:2787/g1/tj.asp
http://xxx.fr***8888.com:26677/***.exe

yingzhou

还是搞不定，出现死机了！有时间再研究一下！