Analysis

  • max time kernel
    111s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 12:57

General

  • Target

    Scan 001.exe

  • Size

    884KB

  • MD5

    9f9d2f84755edf531b370605b273bce8

  • SHA1

    107bb8aff5f090223f34c5da6af3b97899ca66a0

  • SHA256

    e424feff6970c9526c287c805fe886f8e4d37c4620094bc7b3619eb5a68e425f

  • SHA512

    5a40406e8a03f1f16e540ceb6e5921260863850bf8f0f4ae58d2513567e0d82678886a135a3ad939a38384cc7696d010355c907e795b86d03c0f9d867af80b07

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    123456789

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/5cXHFyui

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scan 001.exe
    "C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Users\Admin\68108315\uepa.pif
      "C:\Users\Admin\68108315\uepa.pif" ggilu.kdb
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe"
        3⤵
          PID:572
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe"
          3⤵
            PID:1388
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe"
            3⤵
              PID:1156
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe"
              3⤵
                PID:620
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe"
                3⤵
                  PID:1644
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\SysWOW64\mshta.exe"
                  3⤵
                    PID:896
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe"
                    3⤵
                      PID:1592
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      3⤵
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1748
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"
                        4⤵
                        • Creates scheduled task(s)
                        PID:1104
                      • C:\Users\Admin\AppData\Local\Temp\Wservices.exe
                        "C:\Users\Admin\AppData\Local\Temp\Wservices.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:924

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\68108315\ggilu.kdb

                  Filesize

                  189.1MB

                  MD5

                  a4c0acbd75471d3b6969e81d6d9ce6e2

                  SHA1

                  13fe2ca0e1f65509142689d311328190f84f78d9

                  SHA256

                  8c4eff95e53c7d5358740ebddf1f2ab710bf6edaff7474303b2f5b5f27c76105

                  SHA512

                  e38b3a9bb8c5343183b66b0dfe581f3297aab004ac73425f5e77448af1bab0e0d990430855140d846d38641a06f5e5007aede7e63e81207428174c900d384bae

                • C:\Users\Admin\68108315\kivddcmfwg.jpg

                  Filesize

                  120KB

                  MD5

                  5c9b742a88475c55b8aa557526fa382a

                  SHA1

                  e2cdc4dd9a79ef514f010391a82ec1374b26156f

                  SHA256

                  444ea59d80a254592ebbf261fa0a5078d42746a7e76be10f072a41252a47601b

                  SHA512

                  8b2a601be5168d98b818c02dac2ee9616c69ddfdaf28a75d4420f8ee8c94aef7e02660d9bc5b388b640be1acd5d2fe04113c0bb97be3b3f6399da9f4daa2df9a

                • C:\Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • C:\Users\Admin\AppData\Local\Temp\Wservices.exe

                  Filesize

                  44KB

                  MD5

                  0e06054beb13192588e745ee63a84173

                  SHA1

                  30b7d4d1277bafd04a83779fd566a1f834a8d113

                  SHA256

                  c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

                  SHA512

                  251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

                • C:\Users\Admin\AppData\Local\Temp\Wservices.exe

                  Filesize

                  44KB

                  MD5

                  0e06054beb13192588e745ee63a84173

                  SHA1

                  30b7d4d1277bafd04a83779fd566a1f834a8d113

                  SHA256

                  c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

                  SHA512

                  251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

                • \Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • \Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • \Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • \Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • \Users\Admin\AppData\Local\Temp\Wservices.exe

                  Filesize

                  44KB

                  MD5

                  0e06054beb13192588e745ee63a84173

                  SHA1

                  30b7d4d1277bafd04a83779fd566a1f834a8d113

                  SHA256

                  c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

                  SHA512

                  251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

                • memory/572-64-0x0000000000000000-mapping.dmp

                • memory/620-67-0x0000000000000000-mapping.dmp

                • memory/800-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

                  Filesize

                  8KB

                • memory/896-69-0x0000000000000000-mapping.dmp

                • memory/924-87-0x0000000000350000-0x0000000000370000-memory.dmp

                  Filesize

                  128KB

                • memory/924-86-0x0000000000F00000-0x0000000000F0E000-memory.dmp

                  Filesize

                  56KB

                • memory/924-83-0x0000000000000000-mapping.dmp

                • memory/1104-80-0x0000000000000000-mapping.dmp

                • memory/1156-66-0x0000000000000000-mapping.dmp

                • memory/1388-65-0x0000000000000000-mapping.dmp

                • memory/1592-70-0x0000000000000000-mapping.dmp

                • memory/1604-59-0x0000000000000000-mapping.dmp

                • memory/1644-68-0x0000000000000000-mapping.dmp

                • memory/1748-73-0x0000000000360000-0x000000000095A000-memory.dmp

                  Filesize

                  6.0MB

                • memory/1748-79-0x0000000000360000-0x000000000036C000-memory.dmp

                  Filesize

                  48KB

                • memory/1748-78-0x0000000000360000-0x000000000095A000-memory.dmp

                  Filesize

                  6.0MB

                • memory/1748-76-0x0000000000360000-0x000000000095A000-memory.dmp

                  Filesize

                  6.0MB

                • memory/1748-74-0x0000000000368CCE-mapping.dmp

                • memory/1748-71-0x0000000000360000-0x000000000095A000-memory.dmp

                  Filesize

                  6.0MB