Trojan:WinNT/Duqu.B

Trojan:WinNT/Duqu.B is a variant of WinNT/Duqu, a trojan that could allow unauthorized remote access and control of an affected computer. This trojan component injects payload instructions, detected as Trojan:Win32/Duqu.A, into other processes.

Installation

This trojan may be installed as a device driver named "nfrd965.sys" or "adpu321.sys" and runs as a service at each Windows start. Trojan:WinNT/Duqu.B creates the following devices:

• \Device\Gpd1
• \Device\{624409B3-4CEF-41C0-8B81-7634279A41E5}

Payload

Injects malware into other processes
As with other variants, Trojan:WinNT/Duqu.B reads encrypted configuration data from specific registry subkeys that contain the following information:

• List of target process names, such as "services.exe", used by the trojan to inject malicious code
• Path of the payload file used to inject into processes

The malware was observed to read data from the following registry subkeys:

HKLM\SYSTEM\CurrentControlSet\Services\NFRD965\FILTER
HKLM\SYSTEM\CurrentControlSet\Services\ADPU321\FILTER

The following are examples of file names that contain payload code, detected as Trojan:Win32/Duqu.B:

• %systemroot%\inf\netp191.PNF
• %systemroot%\inf\cmi4432.PNF

Additional information

For more information about Trojan:WinNT/Duqu.A, see the description elsewhere in the encyclopedia.

Analysis by Edgardo Diaz