Analysis

  • max time kernel
    148s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-06-2022 01:29

General

  • Target

    2ba261eaeefcfbd8a6ee73e31c640ccff59e316158fcef0e0bc48ad1c04a5440.exe

  • Size

    696KB

  • MD5

    2fa9b17ba7c0ea2a3753bf750f5504f1

  • SHA1

    8a7402be4a985ba5d6ef8aa0b1d72e6fa2d1e0fa

  • SHA256

    2ba261eaeefcfbd8a6ee73e31c640ccff59e316158fcef0e0bc48ad1c04a5440

  • SHA512

    ef58948e48e9a46bfc2fcb2ceb925ee2762ecdea2fe1ef874aa251707bf81ade296dc07a00c2e688eb2727680bfa2a03c9b481188991d66d72b3f2547cea33cd

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty

Attributes
  • aes_key

    nulled

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/cXuQ0V20

  • delay

    33

  • download_payload

    false

  • install

    false

  • install_name

    Winservices.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \Services\

  • usb_spread

    true

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ba261eaeefcfbd8a6ee73e31c640ccff59e316158fcef0e0bc48ad1c04a5440.exe
    "C:\Users\Admin\AppData\Local\Temp\2ba261eaeefcfbd8a6ee73e31c640ccff59e316158fcef0e0bc48ad1c04a5440.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Maps connected drives based on registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3328

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3328-131-0x0000000000000000-mapping.dmp

  • memory/3328-132-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3328-137-0x0000000074E50000-0x0000000075401000-memory.dmp

    Filesize

    5.7MB

  • memory/3328-138-0x0000000074E50000-0x0000000075401000-memory.dmp

    Filesize

    5.7MB

  • memory/4460-130-0x0000000000270000-0x00000000003F7000-memory.dmp

    Filesize

    1.5MB

  • memory/4460-136-0x0000000000270000-0x00000000003F7000-memory.dmp

    Filesize

    1.5MB