Analysis
- max time kernel
117s - max time network
142s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
18/10/2021, 15:14
General
- Target b45c61350ecdc4abd20c7b0647de3e99.exe
- Size 439KB
- Sample211018-smckaaegej
- SHA256 cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb
Malware Config
Extracted
-
\??\M:\Read_Me.txt
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?102NEWXZACE 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?102NEWXZACE
-
https://yip.su/2QstD5
Extracted
-
limerat
-
1JsnvJrsfqHdZcUKdTGbobAaLWRedczj7R
-
aes_key
7777
-
antivm
false
-
c2_url
https://pastebin.com/raw/peS2LDTc
-
delay
3
-
download_payload
false
-
install
true
-
install_name
svhost.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
- LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Windows security bypass 2 TTPs
- Nirsoft 3 IoCs
- Executes dropped EXE 9 IoCs
- Modifies Installed Components in the registry 2 TTPs
- Windows security modification 2 TTPs 14 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 57 IoCs
- Suspicious use of FindShellTrayWindow 13 IoCs
- Suspicious use of SendNotifyMessage 11 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exe"C:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exe"1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$0C$0:$0\$0W$0i$0n$0d$0o$0w$0s$0\$0R$0e$0s$0o$0u$0r$0c$0e$0s$0\$0T$0h$0e$0m$0e$0s$0\$0a$0e$0r$0o$0\$0S$0h$0e$0l$0l$0\$0ᢾ$0ᣙ$0ᢚ$0ᣉ$0ᢚ$0ᣌ$0ᢜ$0ᢙ$0ᣍ$0ᢞ$0ᢘ$0ᢻ$0ᢟ$0ᣐ$0ᣉ$0\$0s$0v$0c$0h$0o$0s$0t$0.$0e$0x$0e$0" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$0C$0:$0\$0W$0i$0n$0d$0o$0w$0s$0\$0R$0e$0s$0o$0u$0r$0c$0e$0s$0\$0T$0h$0e$0m$0e$0s$0\$0a$0e$0r$0o$0\$0S$0h$0e$0l$0l$0\$0ᢾ$0ᣙ$0ᢚ$0ᣉ$0ᢚ$0ᣌ$0ᢜ$0ᢙ$0ᣍ$0ᢞ$0ᢘ$0ᢻ$0ᢟ$0ᣐ$0ᣉ$0\$0s$0v$0c$0h$0o$0s$0t$0.$0e$0x$0e$0" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exeC:\Users\Admin\AppData\Local\Temp\b45c61350ecdc4abd20c7b0647de3e99.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\svhost.exe'"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$0C$0:$0\$0W$0i$0n$0d$0o$0w$0s$0\$0R$0e$0s$0o$0u$0r$0c$0e$0s$0\$0T$0h$0e$0m$0e$0s$0\$0a$0e$0r$0o$0\$0S$0h$0e$0l$0l$0\$0ᢾ$0ᣙ$0ᢚ$0ᣉ$0ᢚ$0ᣌ$0ᢜ$0ᢙ$0ᣍ$0ᢞ$0ᢘ$0ᢻ$0ᢟ$0ᣐ$0ᣉ$0\$0s$0v$0c$0h$0o$0s$0t$0.$0e$0x$0e$0" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svhost.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$0C$0:$0\$0W$0i$0n$0d$0o$0w$0s$0\$0R$0e$0s$0o$0u$0r$0c$0e$0s$0\$0T$0h$0e$0m$0e$0s$0\$0a$0e$0r$0o$0\$0S$0h$0e$0l$0l$0\$0ᢾ$0ᣙ$0ᢚ$0ᣉ$0ᢚ$0ᣌ$0ᢜ$0ᢙ$0ᣍ$0ᢞ$0ᢘ$0ᢻ$0ᢟ$0ᣐ$0ᣉ$0\$0s$0v$0c$0h$0o$0s$0t$0.$0e$0x$0e$0" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svhost.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"5⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\de6e6108-adc1-4893-9de0-7c3c61ef9719\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\de6e6108-adc1-4893-9de0-7c3c61ef9719\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\de6e6108-adc1-4893-9de0-7c3c61ef9719\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de6e6108-adc1-4893-9de0-7c3c61ef9719\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\de6e6108-adc1-4893-9de0-7c3c61ef9719\AdvancedRun.exe" /SpecialRun 4101d8 17207⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD704.tmp.exe"6⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 24046⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-132-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/644-182-0x0000000007B70000-0x0000000007B71000-memory.dmp
memory/644-292-0x0000000006A94000-0x0000000006A96000-memory.dmp
memory/644-289-0x0000000006A93000-0x0000000006A94000-memory.dmp
memory/644-143-0x0000000006A92000-0x0000000006A93000-memory.dmp
memory/644-131-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/644-141-0x0000000006A90000-0x0000000006A91000-memory.dmp
memory/728-139-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/728-282-0x00000000072B3000-0x00000000072B4000-memory.dmp
memory/728-140-0x00000000072B2000-0x00000000072B3000-memory.dmp
memory/728-152-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/728-135-0x00000000078F0000-0x00000000078F1000-memory.dmp
memory/728-174-0x00000000086A0000-0x00000000086A1000-memory.dmp
memory/728-130-0x0000000007220000-0x0000000007221000-memory.dmp
memory/728-186-0x0000000003530000-0x0000000003531000-memory.dmp
memory/728-286-0x00000000072B4000-0x00000000072B6000-memory.dmp
memory/728-146-0x00000000077E0000-0x00000000077E1000-memory.dmp
memory/728-147-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/728-127-0x0000000003530000-0x0000000003531000-memory.dmp
memory/728-126-0x0000000003530000-0x0000000003531000-memory.dmp
memory/728-150-0x0000000008040000-0x0000000008041000-memory.dmp
memory/1208-801-0x0000000004933000-0x0000000004934000-memory.dmp
memory/1208-756-0x000000007EB50000-0x000000007EB51000-memory.dmp
memory/1208-509-0x0000000004932000-0x0000000004933000-memory.dmp
memory/1208-503-0x0000000004930000-0x0000000004931000-memory.dmp
memory/1560-410-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/1760-1310-0x0000000006DA0000-0x0000000006DA1000-memory.dmp
memory/1760-1392-0x0000000006DA3000-0x0000000006DA4000-memory.dmp
memory/1760-1312-0x0000000006DA2000-0x0000000006DA3000-memory.dmp
memory/1764-1307-0x0000000006962000-0x0000000006963000-memory.dmp
memory/1764-1391-0x0000000006963000-0x0000000006964000-memory.dmp
memory/1764-1306-0x0000000006960000-0x0000000006961000-memory.dmp
memory/1916-604-0x0000000005130000-0x00000000051CC000-memory.dmp
memory/2012-145-0x0000000006C90000-0x0000000006C91000-memory.dmp
memory/2012-138-0x000000000AB30000-0x000000000AB31000-memory.dmp
memory/2012-115-0x0000000000870000-0x0000000000871000-memory.dmp
memory/2012-122-0x000000000A530000-0x000000000A531000-memory.dmp
memory/2012-121-0x0000000008F00000-0x000000000902D000-memory.dmp
memory/2012-118-0x0000000006B80000-0x0000000006B81000-memory.dmp
memory/2012-117-0x0000000005170000-0x0000000005171000-memory.dmp
memory/2112-1314-0x00000000066F0000-0x00000000066F1000-memory.dmp
memory/2112-1315-0x00000000066F2000-0x00000000066F3000-memory.dmp
memory/2112-1393-0x00000000066F3000-0x00000000066F4000-memory.dmp
memory/2300-496-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/2300-500-0x0000000004AB2000-0x0000000004AB3000-memory.dmp
memory/2300-1100-0x0000000004AB4000-0x0000000004AB6000-memory.dmp
memory/2300-1097-0x0000000004AB3000-0x0000000004AB4000-memory.dmp
memory/3100-511-0x00000000046E2000-0x00000000046E3000-memory.dmp
memory/3100-716-0x000000007ECE0000-0x000000007ECE1000-memory.dmp
memory/3100-506-0x00000000046E0000-0x00000000046E1000-memory.dmp
memory/3100-796-0x00000000046E3000-0x00000000046E4000-memory.dmp
memory/3152-178-0x0000000008130000-0x0000000008131000-memory.dmp
memory/3152-162-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3152-163-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3152-172-0x0000000001060000-0x0000000001061000-memory.dmp
memory/3152-173-0x0000000001062000-0x0000000001063000-memory.dmp
memory/3152-248-0x000000007F870000-0x000000007F871000-memory.dmp
memory/3152-298-0x0000000001063000-0x0000000001064000-memory.dmp
memory/3204-1305-0x0000000002F90000-0x0000000002F91000-memory.dmp
memory/3284-295-0x0000000007183000-0x0000000007184000-memory.dmp
memory/3284-129-0x0000000003290000-0x0000000003291000-memory.dmp
memory/3284-142-0x0000000007180000-0x0000000007181000-memory.dmp
memory/3284-128-0x0000000003290000-0x0000000003291000-memory.dmp
memory/3284-249-0x000000007F130000-0x000000007F131000-memory.dmp
memory/3284-144-0x0000000007182000-0x0000000007183000-memory.dmp
memory/3308-1394-0x00000000066B3000-0x00000000066B4000-memory.dmp
memory/3308-1373-0x00000000066B0000-0x00000000066B1000-memory.dmp
memory/3308-1374-0x00000000066B2000-0x00000000066B3000-memory.dmp
memory/3748-1372-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3900-516-0x00000000073F2000-0x00000000073F3000-memory.dmp
memory/3900-1091-0x00000000073F3000-0x00000000073F4000-memory.dmp
memory/3900-514-0x00000000073F0000-0x00000000073F1000-memory.dmp
memory/3900-1094-0x00000000073F4000-0x00000000073F6000-memory.dmp
memory/4008-211-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/4008-157-0x0000000000400000-0x000000000040E000-memory.dmp