limerat | 57638abb65ee04cbd560abcddb83414f992551282310ed4659c74b0687027092

Analysis

max time kernel
149s
max time network
128s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf4cd2f5d664e2a8d60f411dce8359b6.exe
Size

190KB
MD5

bf4cd2f5d664e2a8d60f411dce8359b6
SHA1

1f6dce3eaef268dc95e1c61bcda025a5f46bc5ef
SHA256

57638abb65ee04cbd560abcddb83414f992551282310ed4659c74b0687027092
SHA512

437bf91698dbd44fde048bcf0ea8c91c56eea0693e45a79c8079c6e5ecdc61c82ac28190dd767e87e5e047877a345ed1fc3db7a09ca45a03805877bda1396890

Score

10^/10

limerat neshta persistence rat spyware stealer

Malware Config

Extracted

Family

limerat

Wallets

bc1quxey9qaznc2p3yjkerld76m3ktpewnh7m5ahpt

Attributes

aes_key
103010
antivm
true
c2_url
https://agleamoda.000webhostapp.com/link.html
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exesystem.exe

pid process

1220 bf4cd2f5d664e2a8d60f411dce8359b6.exe
1568 system.exe

pid	process
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1568	system.exe

Loads dropped DLL 10 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exebf4cd2f5d664e2a8d60f411dce8359b6.exesystem.exe

pid	process
1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
1568	system.exe
1568	system.exe
1568	system.exe
1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google.com = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google.com\""	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description pid process target process

PID 1220 set thread context of 536 1220 bf4cd2f5d664e2a8d60f411dce8359b6.exe vbc.exe

description	pid	process	target process
PID 1220 set thread context of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe

Drops file in Program Files directory 64 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Drops file in Windows directory 1 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description ioc process

File opened for modification C:\Windows\svchost.com bf4cd2f5d664e2a8d60f411dce8359b6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Modifies registry class 1 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bf4cd2f5d664e2a8d60f411dce8359b6.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

system.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	system.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	system.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

system.exe

pid process

1568 system.exe
1568 system.exe
1568 system.exe
1568 system.exe
1568 system.exe
1568 system.exe
1568 system.exe
1568 system.exe

pid	process
1568	system.exe
1568	system.exe
1568	system.exe
1568	system.exe
1568	system.exe
1568	system.exe
1568	system.exe
1568	system.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exesystem.exe

description	pid	process
Token: SeDebugPrivilege	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe
Token: SeDebugPrivilege	1568	system.exe
Token: SeDebugPrivilege	1568	system.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

bf4cd2f5d664e2a8d60f411dce8359b6.exebf4cd2f5d664e2a8d60f411dce8359b6.exevbc.exe

description	pid	process	target process
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1192 wrote to memory of 1220	1192	bf4cd2f5d664e2a8d60f411dce8359b6.exe	bf4cd2f5d664e2a8d60f411dce8359b6.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 536	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	vbc.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 1220 wrote to memory of 1568	1220	bf4cd2f5d664e2a8d60f411dce8359b6.exe	system.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe
PID 536 wrote to memory of 1644	536	vbc.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\bf4cd2f5d664e2a8d60f411dce8359b6.exe
"C:\Users\Admin\AppData\Local\Temp\bf4cd2f5d664e2a8d60f411dce8359b6.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 500
4⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\system.exe
C:\Users\Admin\AppData\Local\Temp\system.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\bf4cd2f5d664e2a8d60f411dce8359b6.exe
Filesize
150KB

MD5
c6f1126376dfd5d16c1641d07234c970

SHA1
6f6e58134df09013d8068acec596ca7c36a86c8a

SHA256
a2f8edbdaac7b9bd39841e74b871486352a1c050b41fad8fb65475dd83464a2a

SHA512
71c222d26b08cb37b1ca9f024ead66bdf71e2c21bf1647b9fde83792896f7e4089d092728331c6566cde8b14dcd7ceab8b7c7f714233530cdfbf8b1296d7cf9c

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
30KB

MD5
81bd7febd0342d8d8070c4906a560f19

SHA1
24e82a05b8dd6e7a5283c28c767b816d8940b4bf

SHA256
f96683d8cd888d9e1dd0808454ce9bb0198bde761396b40eb58d8a17b41048d1

SHA512
93cd1725f1738d1b1632c5f65fc6d8a17f5d25c14524db34cfe0c731947690bf9ca256d262e43275cf65a5400a5266a981796568fde76705c39996005f6af294

Download Submit
memory/536-67-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/536-71-0x0000000000402000-0x0000000000408E00-memory.dmp

Filesize
27KB

Download
memory/536-72-0x0000000000402000-0x0000000000408E00-memory.dmp

Filesize
27KB

Download
memory/536-64-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/536-86-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/536-69-0x0000000000408D2E-mapping.dmp

Download
memory/536-63-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/536-66-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/536-68-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1192-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1220-85-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1220-56-0x0000000000000000-mapping.dmp

Download
memory/1568-76-0x0000000000000000-mapping.dmp

Download
memory/1568-87-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Filesize
56KB

Download
memory/1644-78-0x0000000000000000-mapping.dmp

Download