General
-
Target
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
-
Size
78KB
-
Sample
220512-nxrdzagadq
-
MD5
259d498a10482929d3331458526047e5
-
SHA1
9808b64e9dee325393374884344b18e37570a135
-
SHA256
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
-
SHA512
c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
Static task
static1
Behavioral task
behavioral1
Sample
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
limerat
-
aes_key
EIYV1V9YH5dE7u4B6kXr
-
antivm
true
-
c2_url
https://pastebin.com/raw/LtRQn6ir
-
delay
3
-
download_payload
false
-
install
true
-
install_name
mswebhook.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\edge\
-
usb_spread
true
Targets
-
-
Target
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
-
Size
78KB
-
MD5
259d498a10482929d3331458526047e5
-
SHA1
9808b64e9dee325393374884344b18e37570a135
-
SHA256
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
-
SHA512
c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
Score10/10-
Executes dropped EXE
-
Looks for VMWare Tools registry key
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-