Worm:Win32/Hamweq.gen!C

Worm:Win32/Hamweq.gen!C is a generic detection for a worm family that spreads via removable drives, such as USB memory sticks. It contains an IRC-based backdoor, which may be used by a remote attacker to order the affected machine to participate in Distributed Denial of Service attacks, or to download and execute arbitrary files.

When executed, Worm:Win32/Hamweq.gen!C injects code into the "explorer.exe" process, which then copies Hamweq’s executable as a hidden system file to the following folder:

 

c:\restore\s-1-5-21-1482476501-1644491937-682003330-1013

 

The executable uses varied file names such as in following examples:

 

<path>\dark.exe

<path>\taquito.exe

<path>\sweet.exe

 

It also creates a text file named "Desktop.ini" in the same directory, which makes the directory appear as a recycle bin in Windows Explorer. If the executable is being copied from a removable drive, it opens a Windows Explorer window displaying the contents of that drive.

 

It may attempt to delete older versions of itself if these are present.

 

It also creates the following registry entry:

 

Under key: HKLM\Software\Microsoft\Active Setup\Installed Components\{<class id>}

Adds value: "StubPath"

With data: "c:\restore\s-1-5-21-1482476501-1644491937-682003330-1013\<worm file name>"

 

For example, the data and value created in the registry by one variant is as follows:

 

Under key: HKLM\Software\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-25GX1C642122}

Adds value: StubPath

With data: "c:\restore\s-1-5-21-1482476501-1644491937-682003330-1013\dark.exe"

Removable drives

Worm:Win32/Hamweq.gen!C periodically checks for the presence of removable drives (such as USB memory sticks). If one is found (other than in the A: or B: drive), it copies itself to this drive as a hidden system file in the "<drive:>\Restore\S-1-5-21-1482476501-1644491937-682003330-1013" directory. It uses the same filename as that previously used for its copy on the local hard disk. It also creates a file called "Desktop.ini" in the same directory, and an autorun.inf file in the root directory of the removable drive.

 

The autorun.inf file contains execution instructions for the operating system, which are invoked when the drive is viewed using Windows Explorer. It should be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs. The autorun.inf file used by Hamweq is detected as Worm:Win32/Hamweq!inf.

 

Once the infection of the drive has been completed, it sends a message to the backdoor’s controller (see below) advising that it has done so.

Allows limited remote access and control

Once installed, the worm attempts to connect to an Internet Relay Chat (IRC) server such as the following to await commands from a remote attacker:

Commands received from an attacker could request that the worm perform the following activities:

Variants of Win32/Hamweq have been observed being requested to download and execute variants of the Win32/Rimecud family, which were saved to the %userprofile% directory (eg \documents and settings\).

 

Analysis by Elda Dimakiling