Static task
static1
Behavioral task
behavioral1
Sample
1880-66-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1880-66-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
1880-66-0x0000000000400000-0x000000000040E000-memory.dmp
-
Size
56KB
-
MD5
0c22315ba4bb9882e5d4ac515227bb87
-
SHA1
8620ca1f2a93363da7764255e2729f724d18ae8b
-
SHA256
38e78f817791159e651d055b665b11b3cb7a192b994b064403b3065512f0f80a
-
SHA512
07f4aa797f976ea24edb33896f58bf7069cc538e5071b07c601b4eb21786d2e3f7a90cca296dc1260c315d3e67f76ca4a61f9769bb3d7b39ef13dd5c5c2c8f3a
-
SSDEEP
384:kB+Sbj6NKqZE6eWrAiusIsqDyPeBd57cvDKNrCeJE3WNgVjzAzPz76tpWcbQro35:ipq26eWrpu+Pev57S45NK67TcHFj
Malware Config
Extracted
limerat
bc1quxey9qaznc2p3yjkerld76m3ktpewnh7m5ahpt
-
aes_key
103010
-
antivm
true
-
c2_url
https://agleamoda.000webhostapp.com/link.html
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Signatures
-
Limerat family
Files
-
1880-66-0x0000000000400000-0x000000000040E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ