Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-06-2022 02:42

General

  • Target

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe

  • Size

    122KB

  • MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

  • SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

  • SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

  • SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

Score
10/10

Malware Config

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe
    "C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Runtimebroker\Runtimebrokers.exe'"
      2⤵
      • Creates scheduled task(s)
      PID:760
    • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe
      "C:\Users\Admin\Runtimebroker\Runtimebrokers.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Maps connected drives based on registry
      • Suspicious use of AdjustPrivilegeToken
      PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    60KB

    MD5

    308336e7f515478969b24c13ded11ede

    SHA1

    8fb0cf42b77dbbef224a1e5fc38abc2486320775

    SHA256

    889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9

    SHA512

    61ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

    Filesize

    1KB

    MD5

    c88135f33bb4a6fa790f9a60edd29399

    SHA1

    dbc07ee2267570b92a2d218cd0803f304c2b00cb

    SHA256

    4276ad1519dc90d47c157a6b3b0801856a0ff74f1d266fd3c95ccbb238843332

    SHA512

    6eea50953590871193d368ba1bab1a172ae35d01e4def8e86b36bc0b05f1cb6db9b3297e3f5b199bc7c26e6059406be5766e9c6cb60b34eb16d3952132479f3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

    Filesize

    1KB

    MD5

    163082fb6c2e49842dab5fb327927491

    SHA1

    2cb37aa0ceb946b8bda5d46aa5fc9ec3346bf6ae

    SHA256

    4d9dd78f3f93e15e7035303e514e24956df43a9a44054e6b1846dc78a57bce24

    SHA512

    411349aa0d0822d3163550db8acddc4874e4c0a8290101ba429ba124f57deff9eedcf9c624ff198970769bfaf613ecc983d12c376c63b2df2c015be4cd3941e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    da73b867d97793115f55e8c60f8350f6

    SHA1

    798e7e8096078b3f695657ee278178d256e1a578

    SHA256

    adfd025a600d12c23595d67663789ffd4ac34dc63ab7a735f0a5a7fc676505fa

    SHA512

    95d1a84716c3cd07aa2174a1083b231e65ac18cba1ecac5d3f1e8818e985f4d3d3cfec4c2a7966c7779fd71337c911b3f94448ce734d4a23159bb4b8cd51398e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

    Filesize

    398B

    MD5

    867d1585e407039eb54f3dbe2232c2a8

    SHA1

    9d3d3de20cfc76c9889773b40a3a73e6b5b29357

    SHA256

    17766ed79761b520eda853fa8a2c37169a5ffc937edda57cec2c8889bbfcea21

    SHA512

    6bd8be89f6f3270c8b748f3abbb0d27818543ff607314eaeb0e57a07485458ddef72a70acafa79ed06e1b3bdcc5cbf47d711ad501f172f1e2970dd94253d5f00

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

    Filesize

    398B

    MD5

    b48904601e49f6627643b3c9d71fc279

    SHA1

    f3ff854608be9184d558952510f0c29ea6b5ab6d

    SHA256

    cf58886984ed3affc8d1ae04609c7506be4231c2d54c44a9865f069e427f4ad5

    SHA512

    e99f9d907b15603e9e3993ea151963a22e662bb8fa29b67dafa7755b41246c2effad2722e0ab113abe65296917dbc81354b66c74972ebbd5ed51528e40e5dde1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe.js

    Filesize

    152B

    MD5

    f11ea133fdda0acbbe217f2da22451f3

    SHA1

    03f16c90b1b5f0c6e31f2076ee7ade07627f433c

    SHA256

    0cfcf39780002a28f14a59e787b1131b7392f31d1e990b5499f36fa2a581fd62

    SHA512

    ed81732f17d371894cfadc6cb4277a0ebff689c4fc6904c53934d274859b6480a77b8483cf2814f9245b104b736ca3fdba97b8629b06170b0e9d4f30a318306c

  • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • \Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • \Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • memory/760-56-0x0000000000000000-mapping.dmp

  • memory/916-66-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/916-59-0x0000000000000000-mapping.dmp

  • memory/916-72-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/1668-63-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/1668-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB

  • memory/1668-55-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB