Worm:Win32/Rombrast.B

Worm:Win32/Rombrast.B is a worm that spreads via removable drives and USBs. It has been observed connecting to a remote host, which it may do in order to download newer versions of itself.

Installation

When run, the worm drops itself as a randomly-named file with 'hidden' and 'system' attributes:

%APPDATA%\<seven random characters>\<seven random characters>.exe

Worm:Win32/Rombrast.B creates the following registry entry to ensure that its copy executes at each Windows start:

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "seven random characters"
With data: "%APPDATA%\<seven random characters>\<seven random characters>.exe"

The worm also creates a mutex with the same random name as the worm file to ensure that only one instance of itself is running at any one time.

Spreads via...

Removable drives

Once running, Worm:Win32/Rombrast.B drops a copy of itself to the following location with 'hidden' and 'system' attributes, then runs this file:

"%windir%\explorer.exe"

It also places an autorun.inf file in the root directory of the targeted drive. Such autorun.inf files contain execution instructions for the operating system, so that when the removable drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically.

Note: This is particularly common malware behavior, generally utilized in order to spread malware from computer to computer. It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs.

Payload

Contacts remote hosts

Worm:Win32/Rombrast.B may contact the following remote host:

bt01.kasopa.com

Commonly, malware may contact a remote host for the following purposes:

• To confirm Internet connectivity
• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

Hides its presence

The worm hooks the following Windows APIs in an effort to avoid detection from security software:

• LdrLoadDll
• NtDeleteValueKey
• NtEnumerateValueKey
• NtOpenProcess
• NtQueryDirectoryFile
• NtQuerySystemInformation
• NtResumeThread
• NtSetInformationFile
• NtSetValueKey
• NtWriteFile

Analysis by Ferdinand Plazo