Backdoor:Win32/Vedratve.A

Installation

The malware can be installed to a random directory using a random file name.  

• TMBMSRV.exe
• coreServiceShell.exe 

The malware also looks for a service with the name "MicrosoftEngineering". If the service exists, the malware deletes it and creates a new one that points to its own copy, for example:

• Service name: MicrosoftEngineering
• Display name: Microsoft Engineering Service
• Binary path name: <malware path>
• Start type: SERVICE_AUTO_START

The malware creates a system driver component in <system folder>\asm_drivers directory as keymmdrv.sys. This component is detected as Trojan:WinNT/Vedratve.A.

Payload

The threat can do the following on your PC:

• Disable and enable system services
• Stop or end processes
• Upload files to target servers (can be any server provided by the attacker)
• Establish a remote connection
• Create a remote shell
• Copy token privileges of system services

We have seen the malware try to connect to the following server to receive commands from a malicious hacker: 

• tbe1.usdagroup.com

Additional information

When the malware first runs in the background and copies token privileges, it runs the clean program mspaint.exe. It likely does this to help hide itself from being noticed by a user on the PC.

Analysis by Zarestel Ferrer