Remote Host Port Number
212.117.180.211 81
NICK n[USA|XP]8373890
USER s “” “lol” :s
JOIN #newbin#
PONG 422
JOIN #USA (null)
* The following port was open in the system:
Port Protocol Process
1053 TCP lmsn.exe (%AppData%lmsn.exe)
Registry Modifications
* The newly created Registry Value is:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ Windows System Guard = “%AppData%lmsn.exe”
so that lmsn.exe runs every time Windows starts
Memory Modifications
* There was a new process created in the system:
Process Name Process Filename Main Module Size
lmsn.exe %AppData%lmsn.exe 65 536 bytes
File System Modifications
* The following files were created in the system:
# Filename(s) File Size File Hash Alias
1 %AppData%lmsn.exe
[file and pathname of the sample #1] 143 360 bytes MD5: 0x78C02FB6679C78FE6AF17F69AA8DC09F
SHA-1: 0x36FCE73AD5F6BF27E85E12210A409FEADBB4AC0B Backdoor.LolBot [PCTools]
2 %System%winsvncs.txt 0 bytes MD5: 0xD41D8CD98F00B204E9800998ECF8427E
SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709 (not available)