Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-05-2022 23:50

General

  • Target

    03a3bd2bd48400c35d8b458d9045cd113bbda03d9bd1a41fecae8177ee71aaf4.exe

  • Size

    565KB

  • MD5

    aae45fe858ee508a8787bff9f58cb847

  • SHA1

    943994afdd05db0aef81cb466bb239db37e009d5

  • SHA256

    03a3bd2bd48400c35d8b458d9045cd113bbda03d9bd1a41fecae8177ee71aaf4

  • SHA512

    b31ed56820062c91351014ffbffb676f9f93026d094e5e96ec7546a458bf9ef0f87f7d6d572613065b594a8dd2d75c1d44a2d4be808b08de6071c2048438e02d

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

359Z6KxMenwvgkA7vpGeBtinJPTj5raZz8

Attributes
  • aes_key

    arglobal

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/CV5RHE9G

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03a3bd2bd48400c35d8b458d9045cd113bbda03d9bd1a41fecae8177ee71aaf4.exe
    "C:\Users\Admin\AppData\Local\Temp\03a3bd2bd48400c35d8b458d9045cd113bbda03d9bd1a41fecae8177ee71aaf4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1236-88-0x0000000074550000-0x0000000074673000-memory.dmp

    Filesize

    1.1MB

  • memory/1236-86-0x0000000071710000-0x0000000071EF0000-memory.dmp

    Filesize

    7.9MB

  • memory/1236-97-0x000000006F2F0000-0x000000007000D000-memory.dmp

    Filesize

    13.1MB

  • memory/1236-96-0x0000000074550000-0x0000000074673000-memory.dmp

    Filesize

    1.1MB

  • memory/1236-95-0x0000000074680000-0x0000000074851000-memory.dmp

    Filesize

    1.8MB

  • memory/1236-94-0x0000000071EF0000-0x0000000072900000-memory.dmp

    Filesize

    10.1MB

  • memory/1236-73-0x0000000000408C1E-mapping.dmp

  • memory/1236-93-0x0000000072900000-0x0000000073C8F000-memory.dmp

    Filesize

    19.6MB

  • memory/1236-75-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1236-91-0x0000000073DE0000-0x0000000073EDC000-memory.dmp

    Filesize

    1008KB

  • memory/1236-90-0x000000006F2F0000-0x000000007000D000-memory.dmp

    Filesize

    13.1MB

  • memory/1236-89-0x0000000074180000-0x0000000074314000-memory.dmp

    Filesize

    1.6MB

  • memory/1236-87-0x0000000074680000-0x0000000074851000-memory.dmp

    Filesize

    1.8MB

  • memory/1236-85-0x0000000071EF0000-0x0000000072900000-memory.dmp

    Filesize

    10.1MB

  • memory/1236-69-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1236-68-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1236-71-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1236-77-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1236-84-0x0000000072900000-0x0000000073C8F000-memory.dmp

    Filesize

    19.6MB

  • memory/1236-92-0x0000000070FD0000-0x000000007170E000-memory.dmp

    Filesize

    7.2MB

  • memory/1236-72-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1672-58-0x0000000071EF0000-0x0000000072900000-memory.dmp

    Filesize

    10.1MB

  • memory/1672-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

    Filesize

    8KB

  • memory/1672-79-0x0000000072900000-0x0000000073C8F000-memory.dmp

    Filesize

    19.6MB

  • memory/1672-82-0x00000000744E0000-0x0000000074674000-memory.dmp

    Filesize

    1.6MB

  • memory/1672-83-0x00000000709F0000-0x000000007170D000-memory.dmp

    Filesize

    13.1MB

  • memory/1672-60-0x0000000074680000-0x0000000074851000-memory.dmp

    Filesize

    1.8MB

  • memory/1672-54-0x00000000002B0000-0x0000000000344000-memory.dmp

    Filesize

    592KB

  • memory/1672-56-0x0000000072900000-0x0000000073C8F000-memory.dmp

    Filesize

    19.6MB

  • memory/1672-81-0x0000000074680000-0x0000000074851000-memory.dmp

    Filesize

    1.8MB

  • memory/1672-80-0x0000000071EF0000-0x0000000072900000-memory.dmp

    Filesize

    10.1MB

  • memory/1672-64-0x00000000702B0000-0x00000000709EE000-memory.dmp

    Filesize

    7.2MB

  • memory/1672-65-0x0000000074200000-0x00000000742C9000-memory.dmp

    Filesize

    804KB

  • memory/1672-63-0x00000000743E0000-0x00000000744DC000-memory.dmp

    Filesize

    1008KB

  • memory/1672-62-0x00000000709F0000-0x000000007170D000-memory.dmp

    Filesize

    13.1MB

  • memory/1672-61-0x00000000744E0000-0x0000000074674000-memory.dmp

    Filesize

    1.6MB

  • memory/1672-59-0x0000000071710000-0x0000000071EF0000-memory.dmp

    Filesize

    7.9MB

  • memory/1672-66-0x0000000072900000-0x0000000073C8F000-memory.dmp

    Filesize

    19.6MB

  • memory/1672-57-0x0000000001E90000-0x0000000001EA8000-memory.dmp

    Filesize

    96KB

  • memory/1672-67-0x0000000071EF0000-0x0000000072900000-memory.dmp

    Filesize

    10.1MB