Malware Analysis Report

2024-11-16 13:10

Sample ID 220706-exewhaggbm
Target Image Logger.exe
SHA256 7f32bdcd399fa93871bf7fe257e3cc3516a03bb8b43cb9ad308a6110ed615c82
Tags
limerat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7f32bdcd399fa93871bf7fe257e3cc3516a03bb8b43cb9ad308a6110ed615c82

Threat Level: Known bad

The file Image Logger.exe was found to be: Known bad.

Malicious Activity Summary

limerat rat

Limerat family

LimeRAT

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-06 04:18

Signatures

Limerat family

limerat

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-06 04:18

Reported

2022-07-06 04:21

Platform

win10v2004-20220414-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Image Logger.exe"

Signatures

LimeRAT

rat limerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Image Logger.exe N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\Image Logger.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe'"

C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.68.143:443 pastebin.com tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
US 13.89.178.27:443 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
US 209.197.3.8:80 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
NL 88.221.144.179:80 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp
N/A 127.0.0.1:680 tcp

Files

memory/2368-130-0x0000000000B40000-0x0000000000B4C000-memory.dmp

memory/2368-131-0x00000000054C0000-0x000000000555C000-memory.dmp

memory/2368-132-0x0000000005580000-0x00000000055E6000-memory.dmp

memory/2368-133-0x0000000006140000-0x00000000066E4000-memory.dmp

memory/3388-134-0x0000000000000000-mapping.dmp

memory/5068-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe

MD5 dfa691f00692d6c327bf2ae9bf179422
SHA1 4dd42465ca7b662c8b16365200e45de1c2114185
SHA256 7f32bdcd399fa93871bf7fe257e3cc3516a03bb8b43cb9ad308a6110ed615c82
SHA512 4e11595b4ba0e156aaa62d48fb694973dd6f45a1c11a7ee8623f6041277fa7c415bcdeaec8633815be8539d6ca09f2a8ab0cbe266effb4086b84023267e50f14

C:\Users\Admin\AppData\Local\Temp\System\Image Logger.exe

MD5 dfa691f00692d6c327bf2ae9bf179422
SHA1 4dd42465ca7b662c8b16365200e45de1c2114185
SHA256 7f32bdcd399fa93871bf7fe257e3cc3516a03bb8b43cb9ad308a6110ed615c82
SHA512 4e11595b4ba0e156aaa62d48fb694973dd6f45a1c11a7ee8623f6041277fa7c415bcdeaec8633815be8539d6ca09f2a8ab0cbe266effb4086b84023267e50f14

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Image Logger.exe.log

MD5 8a1197be130e48aa5aeeafd43eb6bb9f
SHA1 cb790c7c216e41524348eaa0e5b74926e78dbfc6
SHA256 547474087ec8f71dfd32b76f9b74c86f9844addf5082df37562a2c2c0cae4bfb
SHA512 4ad9d8dbbc253c8d7b1c2b4ec5f115c770f02bdbbc21ca0b422e251a3a98331e169c5062cabf7da81d5ae0d295b3778ef105ef82709df1a4ace71be288b8f166