Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-09-2021 01:26
General
-
Target
3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr
-
Size
616KB
-
MD5
2f79e1ce8c8dde93cf2664eab439b767
-
SHA1
b294ba2284d45bfdaa842dd133c6c07f73bdc42d
-
SHA256
55a7e512b86fee0bce3567e636c158a51fda03df1a2956cc2f20603e1c68a3d0
-
SHA512
0e9ab1f5c65dc51054b81d2ab0b8fefbefbe9c8f0b06efb1c710421e1e875f60e81d1612a25e42ac4d60a189708efa238e036258a86b24c7d5470bf4a0d75a0f
Malware Config
Extracted
limerat
bc1qe88ygu7xcv94gtk6wdnkhks5dpchwnvasjr4pf
-
aes_key
lime
-
antivm
true
-
c2_url
https://pastebin.com/raw/d2wuKbQW
-
delay
4
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 2 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr" /S1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AJUgiYbHhTGrD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B2D.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w3tyngdx\w3tyngdx.cmdline"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c5sdlwju\c5sdlwju.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B74.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B73.tmp"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uspsjmqn\uspsjmqn.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C01.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9C00.tmp"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1tsg2bwp\1tsg2bwp.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D29.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D28.tmp"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4f1101e96bb2eaff7fecad457e925120
SHA1489aaff424154a7a17d5f0b4522a64537dc5c2ff
SHA25607618608dc4186ebb9a76d98364358e0362ca23ccc36d3773f0db3d163dc3bff
SHA5124f22c3cc14862bdda44b18e70cfbab6501bcdab8d00766059030d07290070c58ce623d04433aeb170aeb8b3b2adb79e0d5232c5f1031eb3d4e8f6f8e0a99e577
-
MD5
9faa41df1c412e753d61c00bf188f4d7
SHA1fe297cb61198541c5f3af0c66f4640990b3ae9d8
SHA256b9157ebebfdee67c2aea3a86169ed0de9e65777a41e9409536189afae2dbc51b
SHA512c9c658f65009bbe7e56ce7bdcfc79555e81b56824c2cb361a634c556239c8bb1d126582691af3d469d085b27703efd1a8364d7c1109d3cc606e9be9ac8f5f0cd
-
MD5
4a44c5f56bc6117589d47eae71883acc
SHA1840e6eef1b3feadb1ddbfb918ee4def590204783
SHA2569be8ce02d3d60ec8427524c0302cf5984b9b1328de9ca377bd659c72c46f37ad
SHA512caab752e8d68505c0e79091800e028acfdb243bf0a2a826d68f52d592e41f7b1cbfe34d00958e92c85102f99b5f7a0a5d6d2a53e960eca61fe9ef032d48d865e
-
MD5
1541461d25901aa7c0c00380bcc4b041
SHA1f6933952e0771bef2913bf636bf8722e41e8f0d2
SHA256856dd1bd9b5712b5e84357edc8f0a99079095290306285eb70e9ff72a065bab8
SHA5126b34dcafe4712297618220286e254469e124ac1308957d824b0045d65a138572ab8b3ab6e9832c999cbda5099a1607b61e23a7b889ae064f2b711c899376dc77
-
MD5
f2bfcaef1b86b9c6c99e2cf4e416b169
SHA1dbd3cc224bd55f596a45819fd0a7bc654bb68b0c
SHA256369d3994bef8f5358bc2be8b81de62e0610f4ceae9f9d07b4ee224cff6745b5a
SHA512b1cb91018b254bbb00dca43497afe0f14635067d83c854e724856580cfe5b74954be65fd1d670b58af78810c3f06446ab0cb1133abf753e6a1b99d794dac50b9
-
MD5
e65d7d575381f657f8a9d447b0de3313
SHA1d16bf6aba536a10e54ae4565d5c5c20f206fe03f
SHA25661300130aeb4c0506705100197e64d49140ef9f3b7b05c45b8e47f5f7965f1f8
SHA51212a1ce8d871418ddb6db1441527dd14b434715248c660ddf31cb5160b0b3d8e468d607de3dc8fa5dbc1825eb035af70717363c4a420179a6de0c28d81c6162fa
-
MD5
1c5037a04b88f72eb8d3b9ec75aaf5f2
SHA1ffc09b01e6501fb08b65ed2f008cf867b5801b0f
SHA256b2a55c3e58a78abff35866d08c51a4bb7ec76b014b0f3f79087c5997736d0ebf
SHA512d321db1d310ef99bf0a92ea59c2b235e0cd924d8ad467acb1d01564697daed1f232d725397ec3c43ce781ddc0ccaea934e32e385a386de4528b19c722dfb225b
-
MD5
105c773e0a7951b5c97bac289c2f9440
SHA1dcadfffbab7645d83f465260942e2edf8be503f1
SHA25632e65e55b7db805bb02c1f39abb5908243848088d3a20281f56ba2164cbb72f4
SHA512f886f2963eb93de3e7b74b908e1f8800f43f23a7acc125a66f5f0112e7010fece674898869445ced3b2beb0bdbd6968bc70299a1314013f98a1d7893b6e2e1d3
-
MD5
471a8ac17a0d67412b9cbf522f1a49f4
SHA1700608969280bfb9f5af62ef1b57675726612e81
SHA2569e4c87b12643f3fa137293b86aaeba974c1690088abd77e88ea05aae798e3969
SHA51215df94c38a88f26ebf6d6f854c18138b66e2f0acd915e6a7358eaf8a6be2dd8fa4204db4ce8cf5ca5f6e2ffc2afac1faf789d824af0a61a1f2b739e6e3a0f953
-
MD5
afe48426876eedacfdba91eb5176ecf8
SHA19da744cfff5427e51c2e7d091408539e03d80a05
SHA256387dee5276fe1bb1c2c247e24436b03af42c504b6c4c48ed74ddaeae63c7cd6e
SHA512f22abfb811911e8fdf4cb4df9d980beb9350e3be987debd4989b4a9afb0b0c45966600f013f2822adf26328335a6e39fe2326063aae8c24df5a3fcc9fcc9c926
-
MD5
a3487b776d060a4552667931e5382936
SHA1fe13f9c7c180fac565d5f4ce2c88b1fb8b8023ed
SHA256d12f09ec4b6d340bfbc6ab928f127a1482e3fd6a4eff6ec090875cdfad642f45
SHA512e06e4ea67baf67314ae42e23c9737c675f07528c9c66a0ddfc42084be4a0f086c97f10c75015c7f93bdf229e0790136844af227562107627de5b2af00d69985e
-
MD5
eb7a3f68ceac4a230a060cd5056dcc5a
SHA1b84047c053b4e1ace70fb47df7d6ffba8551370e
SHA256d7150437b76b84dc43c2919a4b52015c07e12771269ea8ff1c386499acd8042e
SHA51291339d546e1bce6bb0730c77041932e1e37a006484fd7a3fd2c8de4784df41bfa0b573559159d2f9aa0aec83ffcf7c909b7ad31b5242e983bdaf2edeb1ed8cdc
-
MD5
c6632b4df5a002e7d5e930247d508507
SHA19eaed1483e1bf696947444c15fd73dd37acd15f5
SHA256eca03f0b15ef5da79b7c2b1d703d59fb22142d61779742fcd9edeb7429394142
SHA512328c4df88e63b57c7555784875fad55d6ce1a4696bb05fae941cff45ad2235c4ce98b849575975674dad9ceccdc57af8a7e92096e5539ef13932a5c3cf149ca3
-
MD5
e1aab3feb0680299e688274d733fcbf0
SHA1440b2f478aed9690b69aae4cde1cc2f54a0d5a4d
SHA25699b0f658f5e5d3ffe290c064e7d98fa2c6f57373913d1b3e8c0c889860e04d7d
SHA512c2f6fe84550d9d1ee67f95006d0d381f3950e59e2c65f7a5cea5d6846795cfffa24b1e57129c7061b6e168187126dd6c6100f3266a2bc867353309e46a7bb2a1
-
MD5
ed5a964e00f4a03ab201efe358667914
SHA1d5d5370bbe3e3ce247c6f0825a9e16db2b8cd5c5
SHA256025fc246f13759c192cbbae2a68f2b59b6478f21b31a05d77483a87e417906dd
SHA5127f3b68419e0914cec2d853dcd8bbb45bf9ed77bdde4c9d6f2ea786b2ba99f3e49560512fbb26dd3f0189b595c0c108d32eb43f9a6f13bbc35b8c16b1561bd070
-
MD5
2d14fe9fa6d3f40a6ecef5d5446a763a
SHA1f312cd8312a41c5aed3bb609be3f7e9a1bc4f0f5
SHA25603549b1b39e9b471c0c95a9dc673fd0c5be53ccfe81cf7811580aa59f2ed4fbb
SHA512562f34d14216f50a7641afd2d927ee2ee0512389b097112d111a88709241f9e777d79e7f1a3ef5dd172d6efbb68d65f0161e13020baeb74ff4c16b060e4111df
-
MD5
ee136b4101d0e996d462c2c5de0beb95
SHA165cfa6ea0637548488e869ed8ac02c87906c0a5b
SHA256d8b40d56ccc920590d12e1bb90c39e608e7176b97a0c4ad5acd36019e619b3d5
SHA512faaf7f3dfcef2e2bef2cea7b99f793d1d8e114846412fd5522daed5eb58eb453c2b87a34ce76da4da9880d0d09ab6cc227a32d02fbd90d6aba25a8f04a6dbc82
-
MD5
b2d35307c54450031b14fe5d694504d1
SHA117162851491fc499354ff1ec3dfa9912a07fb2c5
SHA256a8543223e7c0cf878d52102af6dd4df94a6089da16caec76ab7dd98ec9297012
SHA51202003d491e8f3d98cec43f815f9cc48036594a67052372bdfd47686e5cd3f38769b2ec43d06b560ebe43ef11813916ee006d633c84662b76bddc645d8c009886
-
MD5
45ecaf5e82da876240f9be946923406c
SHA10e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
SHA256087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
SHA5126fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
-
MD5
45ecaf5e82da876240f9be946923406c
SHA10e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
SHA256087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
SHA5126fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
12.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
-
-
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
48KB
-
Filesize
96KB
-
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
40KB
-