Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe
Resource
win7-20220414-en
General
-
Target
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe
-
Size
122KB
-
MD5
bc9abd0fbf42ca1b0b66795ed0824fe1
-
SHA1
1653c76116eb002fef4a5c608d43d706b2321931
-
SHA256
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682
-
SHA512
d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Runtimebrokers.exepid process 4032 Runtimebrokers.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe -
Drops startup file 2 IoCs
Processes:
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exeRuntimebrokers.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe.js 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe.js Runtimebrokers.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exeRuntimebrokers.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Runtimebrokers.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Runtimebrokers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Runtimebrokers.exedescription pid process Token: SeDebugPrivilege 4032 Runtimebrokers.exe Token: SeDebugPrivilege 4032 Runtimebrokers.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exedescription pid process target process PID 4492 wrote to memory of 1820 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe schtasks.exe PID 4492 wrote to memory of 1820 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe schtasks.exe PID 4492 wrote to memory of 1820 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe schtasks.exe PID 4492 wrote to memory of 4032 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe Runtimebrokers.exe PID 4492 wrote to memory of 4032 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe Runtimebrokers.exe PID 4492 wrote to memory of 4032 4492 2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe Runtimebrokers.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe"C:\Users\Admin\AppData\Local\Temp\2b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682.exe"1⤵
- Checks computer location settings
- Drops startup file
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Runtimebroker\Runtimebrokers.exe'"2⤵
- Creates scheduled task(s)
PID:1820
-
-
C:\Users\Admin\Runtimebroker\Runtimebrokers.exe"C:\Users\Admin\Runtimebroker\Runtimebrokers.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize1KB
MD5c88135f33bb4a6fa790f9a60edd29399
SHA1dbc07ee2267570b92a2d218cd0803f304c2b00cb
SHA2564276ad1519dc90d47c157a6b3b0801856a0ff74f1d266fd3c95ccbb238843332
SHA5126eea50953590871193d368ba1bab1a172ae35d01e4def8e86b36bc0b05f1cb6db9b3297e3f5b199bc7c26e6059406be5766e9c6cb60b34eb16d3952132479f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585
Filesize1KB
MD5163082fb6c2e49842dab5fb327927491
SHA12cb37aa0ceb946b8bda5d46aa5fc9ec3346bf6ae
SHA2564d9dd78f3f93e15e7035303e514e24956df43a9a44054e6b1846dc78a57bce24
SHA512411349aa0d0822d3163550db8acddc4874e4c0a8290101ba429ba124f57deff9eedcf9c624ff198970769bfaf613ecc983d12c376c63b2df2c015be4cd3941e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize398B
MD509a6d60d31b6046b5ca6f0b646839d93
SHA16ed5429cc04aeeea57d68f3506ccc487fc15d18f
SHA256e2cdadff0fa6df88e07fefcf05b1b2d6f141fe6d4fd967897d6cb43a2edc18ee
SHA512736ffd214cbe783369a458f1af322ad29287178843b75d05e7e4ee7665a62f19890fa2fb666de92fd83a5e40c1d3ff02c52ff4b9a194426db2b3faa19e1558c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585
Filesize398B
MD510794d8f8a703a374c8942b4b2d31eb2
SHA186ee59b6fcf2a513d1ec66fa532d181c255be666
SHA256917b488b9e614052480638acf8742c84b04de69603e976474acb37216d3e0356
SHA5124a3303810d9fbcf78a9bf1534c72a8f747068bd86e794ee3c6cc6f6ec3592ea20a59aea888fc51ea2b9b60ab5edc3c422c7a86e9f41aadc3d13939e4139f1989
-
Filesize
152B
MD5f11ea133fdda0acbbe217f2da22451f3
SHA103f16c90b1b5f0c6e31f2076ee7ade07627f433c
SHA2560cfcf39780002a28f14a59e787b1131b7392f31d1e990b5499f36fa2a581fd62
SHA512ed81732f17d371894cfadc6cb4277a0ebff689c4fc6904c53934d274859b6480a77b8483cf2814f9245b104b736ca3fdba97b8629b06170b0e9d4f30a318306c
-
Filesize
122KB
MD5bc9abd0fbf42ca1b0b66795ed0824fe1
SHA11653c76116eb002fef4a5c608d43d706b2321931
SHA2562b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682
SHA512d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151
-
Filesize
122KB
MD5bc9abd0fbf42ca1b0b66795ed0824fe1
SHA11653c76116eb002fef4a5c608d43d706b2321931
SHA2562b4bc8b34bb3af3f7cbfe1496ca6c0144d2cecce197e3ab949c88b68db8b5682
SHA512d545d28e1f466be859374e9a29c91389df1df4fe627fec681e5d0f105228d66bbc88e7750b56da2255ea764a9cf4057f9203ed4ba44460dd806539e4ba531151