Analysis
-
max time kernel
152s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-05-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe
-
Size
501KB
-
MD5
b10331a3adbcbaeb291fdd3aaa0b6be4
-
SHA1
d82f75044514ae3e41fdeda8110b6d1e126044d2
-
SHA256
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6
-
SHA512
8c237a3421886075eb4e041864d5e4e01bab3f9100222a0e515bfb46d75dc59c4e3770b36b0e14c07ec1bfb346831948f6a38ce8979c39c810ed463e4127f234
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
lavin
-
antivm
false
-
c2_url
https://pastebin.com/raw/kgLg0ny1
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3184-130-0x0000000000C60000-0x0000000000D86000-memory.dmp upx behavioral2/memory/3184-137-0x0000000000C60000-0x0000000000D86000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3184-137-0x0000000000C60000-0x0000000000D86000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exedescription pid process target process PID 3184 set thread context of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3468 RegAsm.exe Token: SeDebugPrivilege 3468 RegAsm.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exepid process 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exepid process 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exedescription pid process target process PID 3184 wrote to memory of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 3184 wrote to memory of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 3184 wrote to memory of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 3184 wrote to memory of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 3184 wrote to memory of 3468 3184 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe"C:\Users\Admin\AppData\Local\Temp\0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468
-