Static task
static1
Behavioral task
behavioral1
Sample
536-67-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
536-67-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
536-67-0x0000000000400000-0x000000000040E000-memory.dmp
-
Size
56KB
-
MD5
1ed22821ee89b7730e45d623a30d9535
-
SHA1
a81ffa72774cdf2f147cbc3385f3eaf143ada2c5
-
SHA256
7437e0301eb6276c3c28dc34eabc6a7be89b1059021efcea8a96963f811c7ae9
-
SHA512
d9e648afbc9dcf9cadf85026c0d47ed81ef0f7669a0266ac922e0f7f3a5b13c0327ec9ccc1af0246f5ea24c676710026aa5922c1650bed339d439af408ada641
-
SSDEEP
384:kB+Sbj6NKqZE6eWrAiusIsqDyPeBd57cvDKNrCeJE3WNgVjzAzPz76tpWcbQro35:ipq26eWrpu+Pev57S45NK67TcHFj
Malware Config
Extracted
limerat
bc1quxey9qaznc2p3yjkerld76m3ktpewnh7m5ahpt
-
aes_key
103010
-
antivm
true
-
c2_url
https://agleamoda.000webhostapp.com/link.html
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Signatures
-
Limerat family
Files
-
536-67-0x0000000000400000-0x000000000040E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ