Overview

overview

10

Static

static

10

HEUR-Troja...e0.exe

windows7-x64

10

HEUR-Troja...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan.Win32.Generic-297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe

  • Size

    164KB

  • Sample

    220927-wsk1dsfbgr

  • MD5

    df0b023471306ceb44a253d7cfd86abc

  • SHA1

    36b498e04a1777bbea6582f9d1a0820f96cabe97

  • SHA256

    297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0

  • SHA512

    2334f5dad874d44b7180241247f959d36b5d58fe8625c2b5013dd6bd751998a5ad9055b3c5255b95cb8a05eda2a06f566ab77bd45a54bd6923588c05b76e956c

  • SSDEEP

    3072:/I/0W2G4b/gFbGbj2koc34mwAEoznq1vK7rbKO5oqoO0MhwNz:/RjG40RGb3X34Hknq1cm20NN

Score
10/10
limeratevasionpersistenceransomwarerattrojan

Malware Config

Targets

    • Target

      HEUR-Trojan.Win32.Generic-297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe

    • Size

      164KB

    • MD5

      df0b023471306ceb44a253d7cfd86abc

    • SHA1

      36b498e04a1777bbea6582f9d1a0820f96cabe97

    • SHA256

      297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0

    • SHA512

      2334f5dad874d44b7180241247f959d36b5d58fe8625c2b5013dd6bd751998a5ad9055b3c5255b95cb8a05eda2a06f566ab77bd45a54bd6923588c05b76e956c

    • SSDEEP

      3072:/I/0W2G4b/gFbGbj2koc34mwAEoznq1vK7rbKO5oqoO0MhwNz:/RjG40RGb3X34Hknq1cm20NN

    Score
    10/10
    limeratevasionransomwarerattrojanpersistence

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks