Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:11
Static task
static1
Behavioral task
behavioral1
Sample
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe
Resource
win7-20220414-en
General
-
Target
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe
-
Size
28KB
-
MD5
f73d2a6cc30b843a528073f9e89a9474
-
SHA1
138d45ae3a1a04ca532384966495605bc46a1c84
-
SHA256
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5
-
SHA512
c7b7c1313c6a2aaea87469eb3bb6cdd64808cf5fc3c01ea8b6f30f01d38f16dbbd0c2663f3a7e17b27e1b4bc418564f80ed66cc7b424bbda684e6af31ee7ba17
Malware Config
Extracted
limerat
-
aes_key
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-
antivm
true
-
c2_url
https://pastebin.com/raw/bf4enpi6
-
delay
3
-
download_payload
false
-
install
true
-
install_name
lr.tmp.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lr.tmp.exepid process 268 lr.tmp.exe -
Loads dropped DLL 2 IoCs
Processes:
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exepid process 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exelr.tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum lr.tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 lr.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lr.tmp.exedescription pid process Token: SeDebugPrivilege 268 lr.tmp.exe Token: SeDebugPrivilege 268 lr.tmp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exedescription pid process target process PID 1624 wrote to memory of 1604 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe schtasks.exe PID 1624 wrote to memory of 1604 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe schtasks.exe PID 1624 wrote to memory of 1604 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe schtasks.exe PID 1624 wrote to memory of 1604 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe schtasks.exe PID 1624 wrote to memory of 268 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe lr.tmp.exe PID 1624 wrote to memory of 268 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe lr.tmp.exe PID 1624 wrote to memory of 268 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe lr.tmp.exe PID 1624 wrote to memory of 268 1624 91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe lr.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe"C:\Users\Admin\AppData\Local\Temp\91963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\lr.tmp.exe'"2⤵
- Creates scheduled task(s)
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\lr.tmp.exe"C:\Users\Admin\AppData\Local\Temp\lr.tmp.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:268
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5f73d2a6cc30b843a528073f9e89a9474
SHA1138d45ae3a1a04ca532384966495605bc46a1c84
SHA25691963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5
SHA512c7b7c1313c6a2aaea87469eb3bb6cdd64808cf5fc3c01ea8b6f30f01d38f16dbbd0c2663f3a7e17b27e1b4bc418564f80ed66cc7b424bbda684e6af31ee7ba17
-
Filesize
28KB
MD5f73d2a6cc30b843a528073f9e89a9474
SHA1138d45ae3a1a04ca532384966495605bc46a1c84
SHA25691963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5
SHA512c7b7c1313c6a2aaea87469eb3bb6cdd64808cf5fc3c01ea8b6f30f01d38f16dbbd0c2663f3a7e17b27e1b4bc418564f80ed66cc7b424bbda684e6af31ee7ba17
-
Filesize
28KB
MD5f73d2a6cc30b843a528073f9e89a9474
SHA1138d45ae3a1a04ca532384966495605bc46a1c84
SHA25691963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5
SHA512c7b7c1313c6a2aaea87469eb3bb6cdd64808cf5fc3c01ea8b6f30f01d38f16dbbd0c2663f3a7e17b27e1b4bc418564f80ed66cc7b424bbda684e6af31ee7ba17
-
Filesize
28KB
MD5f73d2a6cc30b843a528073f9e89a9474
SHA1138d45ae3a1a04ca532384966495605bc46a1c84
SHA25691963dd82de52d5f3026d723eb654ad9ecfc49622f2c97602fcd5cf05dc79ff5
SHA512c7b7c1313c6a2aaea87469eb3bb6cdd64808cf5fc3c01ea8b6f30f01d38f16dbbd0c2663f3a7e17b27e1b4bc418564f80ed66cc7b424bbda684e6af31ee7ba17