Analysis
-
max time kernel
184s -
max time network
242s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 12:57
Static task
static1
Behavioral task
behavioral1
Sample
Scan 001.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan 001.exe
Resource
win10v2004-20220414-en
General
-
Target
Scan 001.exe
-
Size
884KB
-
MD5
9f9d2f84755edf531b370605b273bce8
-
SHA1
107bb8aff5f090223f34c5da6af3b97899ca66a0
-
SHA256
e424feff6970c9526c287c805fe886f8e4d37c4620094bc7b3619eb5a68e425f
-
SHA512
5a40406e8a03f1f16e540ceb6e5921260863850bf8f0f4ae58d2513567e0d82678886a135a3ad939a38384cc7696d010355c907e795b86d03c0f9d867af80b07
Malware Config
Extracted
limerat
-
aes_key
123456789
-
antivm
false
-
c2_url
https://pastebin.com/raw/5cXHFyui
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
uepa.pifWservices.exepid process 3600 uepa.pif 5032 Wservices.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Scan 001.exeuepa.pifdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Scan 001.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation uepa.pif -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
uepa.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run uepa.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\68108315\\uepa.pif C:\\Users\\Admin\\68108315\\ggilu.kdb" uepa.pif -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uepa.pifdescription pid process target process PID 3600 set thread context of 3652 3600 uepa.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
uepa.pifRegSvcs.exepid process 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3600 uepa.pif 3652 RegSvcs.exe 3652 RegSvcs.exe 3652 RegSvcs.exe 3652 RegSvcs.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
Scan 001.exeuepa.pifRegSvcs.exedescription pid process target process PID 976 wrote to memory of 3600 976 Scan 001.exe uepa.pif PID 976 wrote to memory of 3600 976 Scan 001.exe uepa.pif PID 976 wrote to memory of 3600 976 Scan 001.exe uepa.pif PID 3600 wrote to memory of 3928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4928 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2684 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2684 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2684 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2332 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2332 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 2332 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3524 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3524 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3524 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4268 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4268 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 4268 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 1556 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 1556 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 1556 3600 uepa.pif mshta.exe PID 3600 wrote to memory of 3652 3600 uepa.pif RegSvcs.exe PID 3600 wrote to memory of 3652 3600 uepa.pif RegSvcs.exe PID 3600 wrote to memory of 3652 3600 uepa.pif RegSvcs.exe PID 3600 wrote to memory of 3652 3600 uepa.pif RegSvcs.exe PID 3600 wrote to memory of 3652 3600 uepa.pif RegSvcs.exe PID 3652 wrote to memory of 2944 3652 RegSvcs.exe schtasks.exe PID 3652 wrote to memory of 2944 3652 RegSvcs.exe schtasks.exe PID 3652 wrote to memory of 2944 3652 RegSvcs.exe schtasks.exe PID 3652 wrote to memory of 5032 3652 RegSvcs.exe Wservices.exe PID 3652 wrote to memory of 5032 3652 RegSvcs.exe Wservices.exe PID 3652 wrote to memory of 5032 3652 RegSvcs.exe Wservices.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\68108315\uepa.pif"C:\Users\Admin\68108315\uepa.pif" ggilu.kdb2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3928
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:4928
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:2684
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:2332
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3524
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:4268
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"4⤵
- Creates scheduled task(s)
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\Wservices.exe"C:\Users\Admin\AppData\Local\Temp\Wservices.exe"4⤵
- Executes dropped EXE
PID:5032
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189.1MB
MD5a4c0acbd75471d3b6969e81d6d9ce6e2
SHA113fe2ca0e1f65509142689d311328190f84f78d9
SHA2568c4eff95e53c7d5358740ebddf1f2ab710bf6edaff7474303b2f5b5f27c76105
SHA512e38b3a9bb8c5343183b66b0dfe581f3297aab004ac73425f5e77448af1bab0e0d990430855140d846d38641a06f5e5007aede7e63e81207428174c900d384bae
-
Filesize
120KB
MD55c9b742a88475c55b8aa557526fa382a
SHA1e2cdc4dd9a79ef514f010391a82ec1374b26156f
SHA256444ea59d80a254592ebbf261fa0a5078d42746a7e76be10f072a41252a47601b
SHA5128b2a601be5168d98b818c02dac2ee9616c69ddfdaf28a75d4420f8ee8c94aef7e02660d9bc5b388b640be1acd5d2fe04113c0bb97be3b3f6399da9f4daa2df9a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
646KB
MD5d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA25659e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
SHA51270660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
-
Filesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
Filesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b