Trojan:W32/Lethic

Infection Vector

Lethic gain access into a system via attachments in spam emails.

Behavior

Upon execution, Lethic will first check for the presence of virtual and debugging environment. If found, it will proceed to terminate itself as a way to evade detection and analysis.

If no virtual or debugging environment found, it will proceed to add a registry key to gain persistence and then start locating the explorer.exe module for it to inject malicious code into. It will also add a mutual exclusion object (mutex) into the injected process to ensure that only one instance of itself is running.

Afterwards, it tries to connect to a malicious command and control (C&C) server using Winsock API and then waits for further instructions.

Files created

• C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-196818750\backwindow32.exe

Registry Changes

Lethic adds the following registry keys to run during startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Name: backwindow32 Data: [dropped_path and filename].exe

Network activity

It connects to the following remote server:

• hxxp://93.190[.]139.161:7700
• It also connect to multiple IP addresses via TCP port 25.

Other Behavior

Lethic is capable of performing these tasks:

• Check for virtual and debugging environment by checking the running process for:
• Check if it is being debugged or sandboxed by checking if the following DLL file exist:
• Check the username for these matches:
• Check the filepath if it contains these items:
• Check multiple registry keys for the following virtual environment:

Analysis on file: 7a60ae98b7707de05764d78d508dc3bc946d3108