Analysis
-
max time kernel
111s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 12:57
Static task
static1
Behavioral task
behavioral1
Sample
Scan 001.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan 001.exe
Resource
win10v2004-20220414-en
General
-
Target
Scan 001.exe
-
Size
884KB
-
MD5
9f9d2f84755edf531b370605b273bce8
-
SHA1
107bb8aff5f090223f34c5da6af3b97899ca66a0
-
SHA256
e424feff6970c9526c287c805fe886f8e4d37c4620094bc7b3619eb5a68e425f
-
SHA512
5a40406e8a03f1f16e540ceb6e5921260863850bf8f0f4ae58d2513567e0d82678886a135a3ad939a38384cc7696d010355c907e795b86d03c0f9d867af80b07
Malware Config
Extracted
limerat
-
aes_key
123456789
-
antivm
false
-
c2_url
https://pastebin.com/raw/5cXHFyui
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
uepa.pifWservices.exepid process 1604 uepa.pif 924 Wservices.exe -
Loads dropped DLL 5 IoCs
Processes:
Scan 001.exeRegSvcs.exepid process 800 Scan 001.exe 800 Scan 001.exe 800 Scan 001.exe 800 Scan 001.exe 1748 RegSvcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
uepa.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run uepa.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\68108315\\uepa.pif C:\\Users\\Admin\\68108315\\ggilu.kdb" uepa.pif -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uepa.pifdescription pid process target process PID 1604 set thread context of 1748 1604 uepa.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
uepa.pifRegSvcs.exepid process 1604 uepa.pif 1604 uepa.pif 1604 uepa.pif 1604 uepa.pif 1604 uepa.pif 1604 uepa.pif 1604 uepa.pif 1748 RegSvcs.exe 1748 RegSvcs.exe 1748 RegSvcs.exe 1748 RegSvcs.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
Scan 001.exeuepa.pifRegSvcs.exedescription pid process target process PID 800 wrote to memory of 1604 800 Scan 001.exe uepa.pif PID 800 wrote to memory of 1604 800 Scan 001.exe uepa.pif PID 800 wrote to memory of 1604 800 Scan 001.exe uepa.pif PID 800 wrote to memory of 1604 800 Scan 001.exe uepa.pif PID 1604 wrote to memory of 572 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 572 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 572 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 572 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1388 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1388 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1388 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1388 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1156 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1156 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1156 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1156 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 620 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 620 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 620 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 620 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1644 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1644 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1644 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1644 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 896 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 896 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 896 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 896 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1592 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1592 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1592 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1592 1604 uepa.pif mshta.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1604 wrote to memory of 1748 1604 uepa.pif RegSvcs.exe PID 1748 wrote to memory of 1104 1748 RegSvcs.exe schtasks.exe PID 1748 wrote to memory of 1104 1748 RegSvcs.exe schtasks.exe PID 1748 wrote to memory of 1104 1748 RegSvcs.exe schtasks.exe PID 1748 wrote to memory of 1104 1748 RegSvcs.exe schtasks.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe PID 1748 wrote to memory of 924 1748 RegSvcs.exe Wservices.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\68108315\uepa.pif"C:\Users\Admin\68108315\uepa.pif" ggilu.kdb2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:572
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1388
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1156
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:620
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1644
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:896
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"4⤵
- Creates scheduled task(s)
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\Wservices.exe"C:\Users\Admin\AppData\Local\Temp\Wservices.exe"4⤵
- Executes dropped EXE
PID:924
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189.1MB
MD5a4c0acbd75471d3b6969e81d6d9ce6e2
SHA113fe2ca0e1f65509142689d311328190f84f78d9
SHA2568c4eff95e53c7d5358740ebddf1f2ab710bf6edaff7474303b2f5b5f27c76105
SHA512e38b3a9bb8c5343183b66b0dfe581f3297aab004ac73425f5e77448af1bab0e0d990430855140d846d38641a06f5e5007aede7e63e81207428174c900d384bae
-
Filesize
120KB
MD55c9b742a88475c55b8aa557526fa382a
SHA1e2cdc4dd9a79ef514f010391a82ec1374b26156f
SHA256444ea59d80a254592ebbf261fa0a5078d42746a7e76be10f072a41252a47601b
SHA5128b2a601be5168d98b818c02dac2ee9616c69ddfdaf28a75d4420f8ee8c94aef7e02660d9bc5b388b640be1acd5d2fe04113c0bb97be3b3f6399da9f4daa2df9a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
Filesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215