Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 01:26
General
-
Target
3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr
-
Size
616KB
-
MD5
2f79e1ce8c8dde93cf2664eab439b767
-
SHA1
b294ba2284d45bfdaa842dd133c6c07f73bdc42d
-
SHA256
55a7e512b86fee0bce3567e636c158a51fda03df1a2956cc2f20603e1c68a3d0
-
SHA512
0e9ab1f5c65dc51054b81d2ab0b8fefbefbe9c8f0b06efb1c710421e1e875f60e81d1612a25e42ac4d60a189708efa238e036258a86b24c7d5470bf4a0d75a0f
Malware Config
Extracted
limerat
bc1qe88ygu7xcv94gtk6wdnkhks5dpchwnvasjr4pf
-
aes_key
lime
-
antivm
true
-
c2_url
https://pastebin.com/raw/d2wuKbQW
-
delay
4
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 2 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr" /S1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AJUgiYbHhTGrD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2655.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"C:\Users\Admin\AppData\Local\Temp\3048 - IN2 STYLE - 21.09.2021.doc - PROFORMA INV.PDF.scr"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cxdot5co\cxdot5co.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA341.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7522294778504183A36AE0692DC0311A.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e1d519f4cbce8f0cd351fbde76f83565
SHA11f0790583d545130d944b7ee03889515289ca49b
SHA25676123b5acc5a013a0338866a55b4fb34b1b620cfc8ba97087354236f922fd855
SHA512678b101c986cdec5853776aa0d4d1f29a13a5cedd3b71a26529ac153970acb1f1c07bbd2495c3027c6f83f2733222d120e2ea9306a427a44894f9db8859980c7
-
MD5
ff2148c1ea2773c2d088e4c16d322228
SHA14b0d0281a41cd61e488e0fc2f6fb014cbedd5c37
SHA256372cb767933a0a72105932460a53ece1dfe2253edebc8677b33d806a5fc2a4f1
SHA512c8dcb684394ace4caec727ebe94a1a6fdc5f2ab6a85a6ce9d3dba87b0952bfac9bdfb0d35829e3988b9e59a91332c971ac337a53482d62ee33124c1aa569e225
-
MD5
e099509f9ce12b96e8bc2b7dc332e6a4
SHA13ceb2ce7cf2d5056c887d56010b9e28d0ca145c1
SHA2562036af70b5c5988f903d66b6deab594f435664f14c981ca48af9092f88f4210b
SHA51299c4b10417fa9e9a1e1ecb4568bd3c3625f4b47e598b17938b1fcb95493f7c0013f2338edcbb5684ae8a07ebb55d4b4d92e8196e058fcf7c8c3749641aad82fe
-
MD5
3bc8adeb12a0fcc53a2368d6b2ac06f1
SHA11fbf854011bdb8a6d8b876dd03eb58f70422b5c9
SHA25605d3206e82e3219eaa0ea9825b64eb5d32f542f257a5ff4c72149ebe0a7be12b
SHA5128885b4fc552332b8e667e425afbc9c18ec54fb561a49b085aef5fdc51142efc61bf7d2b868632d1f1a6e03b256b9422be706aa3cfa58a8de6ef15b94abb163cd
-
MD5
a561ca41d3b29c57ab61672df8d88ec9
SHA124567a929b98c2536cd2458fdce00ce7e29710f0
SHA256f8c5b0b66dbab94ebed08de93cf2300c9933db9ba43b468a0cda09602a2520ce
SHA512eede6794c1a7318fa6107069719fb6ea885b2aa0410e70b300fa65e349a7c6798eb232fb8b6ac254821145cf9de5b91846b1e80514a402a3234c1b336223b027
-
MD5
45ecaf5e82da876240f9be946923406c
SHA10e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
SHA256087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
SHA5126fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
-
MD5
45ecaf5e82da876240f9be946923406c
SHA10e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
SHA256087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
SHA5126fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
96KB
-
Filesize
120KB
-
-
Filesize
624KB
-
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-