Analysis

  • max time kernel
    184s
  • max time network
    242s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 12:57

General

  • Target

    Scan 001.exe

  • Size

    884KB

  • MD5

    9f9d2f84755edf531b370605b273bce8

  • SHA1

    107bb8aff5f090223f34c5da6af3b97899ca66a0

  • SHA256

    e424feff6970c9526c287c805fe886f8e4d37c4620094bc7b3619eb5a68e425f

  • SHA512

    5a40406e8a03f1f16e540ceb6e5921260863850bf8f0f4ae58d2513567e0d82678886a135a3ad939a38384cc7696d010355c907e795b86d03c0f9d867af80b07

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    123456789

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/5cXHFyui

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scan 001.exe
    "C:\Users\Admin\AppData\Local\Temp\Scan 001.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\68108315\uepa.pif
      "C:\Users\Admin\68108315\uepa.pif" ggilu.kdb
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe"
        3⤵
          PID:3928
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe"
          3⤵
            PID:4928
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe"
            3⤵
              PID:2684
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe"
              3⤵
                PID:2332
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe"
                3⤵
                  PID:3524
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\SysWOW64\mshta.exe"
                  3⤵
                    PID:4268
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe"
                    3⤵
                      PID:1556
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3652
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"
                        4⤵
                        • Creates scheduled task(s)
                        PID:2944
                      • C:\Users\Admin\AppData\Local\Temp\Wservices.exe
                        "C:\Users\Admin\AppData\Local\Temp\Wservices.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:5032

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\68108315\ggilu.kdb

                  Filesize

                  189.1MB

                  MD5

                  a4c0acbd75471d3b6969e81d6d9ce6e2

                  SHA1

                  13fe2ca0e1f65509142689d311328190f84f78d9

                  SHA256

                  8c4eff95e53c7d5358740ebddf1f2ab710bf6edaff7474303b2f5b5f27c76105

                  SHA512

                  e38b3a9bb8c5343183b66b0dfe581f3297aab004ac73425f5e77448af1bab0e0d990430855140d846d38641a06f5e5007aede7e63e81207428174c900d384bae

                • C:\Users\Admin\68108315\kivddcmfwg.jpg

                  Filesize

                  120KB

                  MD5

                  5c9b742a88475c55b8aa557526fa382a

                  SHA1

                  e2cdc4dd9a79ef514f010391a82ec1374b26156f

                  SHA256

                  444ea59d80a254592ebbf261fa0a5078d42746a7e76be10f072a41252a47601b

                  SHA512

                  8b2a601be5168d98b818c02dac2ee9616c69ddfdaf28a75d4420f8ee8c94aef7e02660d9bc5b388b640be1acd5d2fe04113c0bb97be3b3f6399da9f4daa2df9a

                • C:\Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • C:\Users\Admin\68108315\uepa.pif

                  Filesize

                  646KB

                  MD5

                  d3ffbde7ea1bcb2d0a6e6e12b0306625

                  SHA1

                  d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff

                  SHA256

                  59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d

                  SHA512

                  70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a

                • C:\Users\Admin\AppData\Local\Temp\Wservices.exe

                  Filesize

                  44KB

                  MD5

                  9d352bc46709f0cb5ec974633a0c3c94

                  SHA1

                  1969771b2f022f9a86d77ac4d4d239becdf08d07

                  SHA256

                  2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

                  SHA512

                  13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

                • C:\Users\Admin\AppData\Local\Temp\Wservices.exe

                  Filesize

                  44KB

                  MD5

                  9d352bc46709f0cb5ec974633a0c3c94

                  SHA1

                  1969771b2f022f9a86d77ac4d4d239becdf08d07

                  SHA256

                  2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

                  SHA512

                  13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

                • memory/1556-141-0x0000000000000000-mapping.dmp

                • memory/2332-138-0x0000000000000000-mapping.dmp

                • memory/2684-137-0x0000000000000000-mapping.dmp

                • memory/2944-148-0x0000000000000000-mapping.dmp

                • memory/3524-139-0x0000000000000000-mapping.dmp

                • memory/3600-130-0x0000000000000000-mapping.dmp

                • memory/3652-143-0x0000000001128CCE-mapping.dmp

                • memory/3652-142-0x0000000001120000-0x00000000017E8000-memory.dmp

                  Filesize

                  6.8MB

                • memory/3652-144-0x0000000001120000-0x000000000112C000-memory.dmp

                  Filesize

                  48KB

                • memory/3652-145-0x0000000005F20000-0x0000000005FBC000-memory.dmp

                  Filesize

                  624KB

                • memory/3652-146-0x0000000005FC0000-0x0000000006026000-memory.dmp

                  Filesize

                  408KB

                • memory/3652-147-0x0000000006BD0000-0x0000000007174000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3928-135-0x0000000000000000-mapping.dmp

                • memory/4268-140-0x0000000000000000-mapping.dmp

                • memory/4928-136-0x0000000000000000-mapping.dmp

                • memory/5032-149-0x0000000000000000-mapping.dmp

                • memory/5032-152-0x0000000000D70000-0x0000000000D7E000-memory.dmp

                  Filesize

                  56KB

                • memory/5032-153-0x0000000005540000-0x000000000557C000-memory.dmp

                  Filesize

                  240KB