Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-05-2022 19:57

General

  • Target

    04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5.exe

  • Size

    1.4MB

  • MD5

    e936a9268db132fc3b8ed65344ebf65b

  • SHA1

    d08422c2de8389397020ef04941a30ec5d6d4afa

  • SHA256

    04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5

  • SHA512

    fb8b1607c06e852acf4efe0f64e53eee6034a508abadfd32f1c0b86f03a4b6296ef97f932191488eceeaeb4f2ac5ef7f16942eb8091b8d99f66102bb345144fa

Score
10/10

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    1205

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/iRjhpqQL

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5.exe
    "C:\Users\Admin\AppData\Local\Temp\04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5.exe" "%appdata%\ertyrtr\erttry.exe" /Y
      2⤵
        PID:1952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\ertyrtr\erttry.exe:Zone.Identifier
        2⤵
        • NTFS ADS
        PID:1732
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ren "%appdata%\ertyrtr\erttry.exe.jpg" erttry.exe
        2⤵
          PID:1156
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:320
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Roaming\ertyrtr\erttry.exe.bat
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 300
            3⤵
            • Delays execution with timeout.exe
            PID:2040

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\svhost.exe

        Filesize

        255KB

        MD5

        9af17c8393f0970ee5136bd3ffa27001

        SHA1

        4b285b72c1a11285a25f31f2597e090da6bbc049

        SHA256

        71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

        SHA512

        b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

      • C:\Users\Admin\AppData\Local\Temp\svhost.exe

        Filesize

        255KB

        MD5

        9af17c8393f0970ee5136bd3ffa27001

        SHA1

        4b285b72c1a11285a25f31f2597e090da6bbc049

        SHA256

        71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

        SHA512

        b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

      • C:\Users\Admin\AppData\Roaming\ertyrtr\erttry.exe

        Filesize

        1.4MB

        MD5

        e936a9268db132fc3b8ed65344ebf65b

        SHA1

        d08422c2de8389397020ef04941a30ec5d6d4afa

        SHA256

        04cbed17b97c910331c995a4bdce33616d9fc4ec88527b587a2682240d7fd1b5

        SHA512

        fb8b1607c06e852acf4efe0f64e53eee6034a508abadfd32f1c0b86f03a4b6296ef97f932191488eceeaeb4f2ac5ef7f16942eb8091b8d99f66102bb345144fa

      • C:\Users\Admin\AppData\Roaming\ertyrtr\erttry.exe.bat

        Filesize

        203B

        MD5

        89fd02ba358befbfc6a5974bf4e73d37

        SHA1

        b337542e6424054be1f4497fafed0123a1883483

        SHA256

        28bc0f5cf086b8646094fe7b81276f1dd13e9cf6a474dc6737261faaf2430278

        SHA512

        d8524477ff1b831a5b1c8599094b6e74270af44a6aac64c91d5a6d07fce85580b41c9a33097fe19a7d01b067b0cabee2efb6fc1f3e6e2d85da3493dabacf1f21

      • \Users\Admin\AppData\Local\Temp\svhost.exe

        Filesize

        255KB

        MD5

        9af17c8393f0970ee5136bd3ffa27001

        SHA1

        4b285b72c1a11285a25f31f2597e090da6bbc049

        SHA256

        71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

        SHA512

        b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

      • memory/320-87-0x0000000070880000-0x00000000709A3000-memory.dmp

        Filesize

        1.1MB

      • memory/320-69-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-100-0x0000000070880000-0x00000000709A3000-memory.dmp

        Filesize

        1.1MB

      • memory/320-99-0x0000000072960000-0x0000000073CEF000-memory.dmp

        Filesize

        19.6MB

      • memory/320-98-0x0000000074380000-0x0000000074551000-memory.dmp

        Filesize

        1.8MB

      • memory/320-97-0x0000000071F50000-0x0000000072960000-memory.dmp

        Filesize

        10.1MB

      • memory/320-65-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-66-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-68-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-73-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-96-0x000000006FFA0000-0x00000000706DE000-memory.dmp

        Filesize

        7.2MB

      • memory/320-83-0x0000000071F50000-0x0000000072960000-memory.dmp

        Filesize

        10.1MB

      • memory/320-70-0x00000000004080CE-mapping.dmp

      • memory/320-75-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/320-95-0x0000000074240000-0x000000007433C000-memory.dmp

        Filesize

        1008KB

      • memory/320-92-0x0000000071230000-0x0000000071F4D000-memory.dmp

        Filesize

        13.1MB

      • memory/320-84-0x0000000070A50000-0x0000000071230000-memory.dmp

        Filesize

        7.9MB

      • memory/320-89-0x0000000074560000-0x00000000746F4000-memory.dmp

        Filesize

        1.6MB

      • memory/320-86-0x0000000072960000-0x0000000073CEF000-memory.dmp

        Filesize

        19.6MB

      • memory/320-85-0x0000000074380000-0x0000000074551000-memory.dmp

        Filesize

        1.8MB

      • memory/432-78-0x0000000000000000-mapping.dmp

      • memory/960-81-0x0000000070A50000-0x0000000071230000-memory.dmp

        Filesize

        7.9MB

      • memory/960-77-0x0000000071230000-0x0000000071F4D000-memory.dmp

        Filesize

        13.1MB

      • memory/960-62-0x0000000071F50000-0x0000000072960000-memory.dmp

        Filesize

        10.1MB

      • memory/960-63-0x0000000074560000-0x00000000746F4000-memory.dmp

        Filesize

        1.6MB

      • memory/960-54-0x0000000000ED0000-0x000000000100C000-memory.dmp

        Filesize

        1.2MB

      • memory/960-88-0x0000000072960000-0x0000000073CEF000-memory.dmp

        Filesize

        19.6MB

      • memory/960-90-0x0000000071F50000-0x0000000072960000-memory.dmp

        Filesize

        10.1MB

      • memory/960-55-0x0000000000210000-0x0000000000224000-memory.dmp

        Filesize

        80KB

      • memory/960-91-0x0000000074380000-0x0000000074551000-memory.dmp

        Filesize

        1.8MB

      • memory/960-82-0x0000000074380000-0x0000000074551000-memory.dmp

        Filesize

        1.8MB

      • memory/960-93-0x0000000071230000-0x0000000071F4D000-memory.dmp

        Filesize

        13.1MB

      • memory/960-56-0x0000000076571000-0x0000000076573000-memory.dmp

        Filesize

        8KB

      • memory/960-59-0x0000000072960000-0x0000000073CEF000-memory.dmp

        Filesize

        19.6MB

      • memory/1156-61-0x0000000000000000-mapping.dmp

      • memory/1732-60-0x0000000000000000-mapping.dmp

      • memory/1952-57-0x0000000000000000-mapping.dmp

      • memory/2040-80-0x0000000000000000-mapping.dmp