Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 21:03
Static task
static1
Behavioral task
behavioral1
Sample
Cheats.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
Cheats.exe
-
Size
162KB
-
MD5
9441315c3dea42d126ebe58639cc56c3
-
SHA1
bccd99a0db01f536405143238ac1db70d824eef0
-
SHA256
4771d76dc4677cc16630e9674c2826845a862358b08a91084aefc4ec95451663
-
SHA512
f97047648daeb21a0749fbfff54c6916e402c6ecf71921e527940f6741266250762b9e8ae3e49177deb143c4d76408de7043cb08da3d165d992127c09d885a5d
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
Fanhacks
-
antivm
true
-
c2_url
https://pastebin.com/raw/ETQfrbLD
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Windows Remon.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cheats.exedescription pid process Token: SeDebugPrivilege 3124 Cheats.exe Token: SeDebugPrivilege 3124 Cheats.exe