Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-06-2022 02:42

General

  • Target

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe

  • Size

    122KB

  • MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

  • SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

  • SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

  • SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

Score
10/10

Malware Config

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe
    "C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Maps connected drives based on registry
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Runtimebroker\Runtimebrokers.exe'"
      2⤵
      • Creates scheduled task(s)
      PID:1820
    • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe
      "C:\Users\Admin\Runtimebroker\Runtimebrokers.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Maps connected drives based on registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

    Filesize

    1KB

    MD5

    c88135f33bb4a6fa790f9a60edd29399

    SHA1

    dbc07ee2267570b92a2d218cd0803f304c2b00cb

    SHA256

    4276ad1519dc90d47c157a6b3b0801856a0ff74f1d266fd3c95ccbb238843332

    SHA512

    6eea50953590871193d368ba1bab1a172ae35d01e4def8e86b36bc0b05f1cb6db9b3297e3f5b199bc7c26e6059406be5766e9c6cb60b34eb16d3952132479f3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

    Filesize

    1KB

    MD5

    163082fb6c2e49842dab5fb327927491

    SHA1

    2cb37aa0ceb946b8bda5d46aa5fc9ec3346bf6ae

    SHA256

    4d9dd78f3f93e15e7035303e514e24956df43a9a44054e6b1846dc78a57bce24

    SHA512

    411349aa0d0822d3163550db8acddc4874e4c0a8290101ba429ba124f57deff9eedcf9c624ff198970769bfaf613ecc983d12c376c63b2df2c015be4cd3941e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

    Filesize

    398B

    MD5

    09a6d60d31b6046b5ca6f0b646839d93

    SHA1

    6ed5429cc04aeeea57d68f3506ccc487fc15d18f

    SHA256

    e2cdadff0fa6df88e07fefcf05b1b2d6f141fe6d4fd967897d6cb43a2edc18ee

    SHA512

    736ffd214cbe783369a458f1af322ad29287178843b75d05e7e4ee7665a62f19890fa2fb666de92fd83a5e40c1d3ff02c52ff4b9a194426db2b3faa19e1558c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

    Filesize

    398B

    MD5

    10794d8f8a703a374c8942b4b2d31eb2

    SHA1

    86ee59b6fcf2a513d1ec66fa532d181c255be666

    SHA256

    917b488b9e614052480638acf8742c84b04de69603e976474acb37216d3e0356

    SHA512

    4a3303810d9fbcf78a9bf1534c72a8f747068bd86e794ee3c6cc6f6ec3592ea20a59aea888fc51ea2b9b60ab5edc3c422c7a86e9f41aadc3d13939e4139f1989

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe.js

    Filesize

    152B

    MD5

    f11ea133fdda0acbbe217f2da22451f3

    SHA1

    03f16c90b1b5f0c6e31f2076ee7ade07627f433c

    SHA256

    0cfcf39780002a28f14a59e787b1131b7392f31d1e990b5499f36fa2a581fd62

    SHA512

    ed81732f17d371894cfadc6cb4277a0ebff689c4fc6904c53934d274859b6480a77b8483cf2814f9245b104b736ca3fdba97b8629b06170b0e9d4f30a318306c

  • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • C:\Users\Admin\Runtimebroker\Runtimebrokers.exe

    Filesize

    122KB

    MD5

    bc9abd0fbf42ca1b0b66795ed0824fe1

    SHA1

    1653c76116eb002fef4a5c608d43d706b2321931

    SHA256

    2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682

    SHA512

    d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151

  • memory/1820-131-0x0000000000000000-mapping.dmp

  • memory/4032-132-0x0000000000000000-mapping.dmp

  • memory/4032-141-0x00000000752A0000-0x0000000075851000-memory.dmp

    Filesize

    5.7MB

  • memory/4032-142-0x00000000752A0000-0x0000000075851000-memory.dmp

    Filesize

    5.7MB

  • memory/4492-139-0x00000000752A0000-0x0000000075851000-memory.dmp

    Filesize

    5.7MB

  • memory/4492-130-0x00000000752A0000-0x0000000075851000-memory.dmp

    Filesize

    5.7MB