Analysis
- max time kernel
144s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
04/06/2022, 13:15
General
- Target 102c40347d336ac6d2a49d957243d25040b6970fd54c0fb9e424c491317ce282.exe
- Size 477KB
- Sample220604-qg979aggc6
- SHA256 102c40347d336ac6d2a49d957243d25040b6970fd54c0fb9e424c491317ce282
Malware Config
Extracted
-
limerat
-
1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty
-
aes_key
nulled
-
antivm
true
-
c2_url
https://pastebin.com/raw/cXuQ0V20
-
delay
33
-
download_payload
false
-
install
false
-
install_name
Winservices.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\Services\
-
usb_spread
true
Signatures
- LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops startup file 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\102c40347d336ac6d2a49d957243d25040b6970fd54c0fb9e424c491317ce282.exe"C:\Users\Admin\AppData\Local\Temp\102c40347d336ac6d2a49d957243d25040b6970fd54c0fb9e424c491317ce282.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4904-130-0x0000000000150000-0x000000000026B000-memory.dmp
memory/4904-136-0x0000000000150000-0x000000000026B000-memory.dmp
memory/5056-132-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5056-137-0x0000000074ED0000-0x0000000075481000-memory.dmp
memory/5056-138-0x0000000073760000-0x0000000074260000-memory.dmp
memory/5056-139-0x0000000072FB0000-0x0000000073758000-memory.dmp
memory/5056-140-0x0000000074ED0000-0x0000000075481000-memory.dmp