Analysis

  • max time kernel
    148s
  • max time network
    177s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 17:35

General

  • Target

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d.exe

  • Size

    339KB

  • MD5

    e456517631e88d6c617afcaf827a95c9

  • SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

  • SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

  • SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • SSDEEP

    6144:qp3Fy+BoE7P9N6S29r3HwArJngn2lojvCe11qR:wVhF7P9Nz0r3Q+JNOvf1

Score
10/10

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    IRj3SceatjDfweW/qMMw7g==

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/p8Be8nNX

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Windows Update.exe

  • main_folder

    UserProfile

  • pin_spread

    false

  • sub_folder

    \Windows\

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d.exe
    "C:\Users\Admin\AppData\Local\Temp\da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d.exe
      "C:\Users\Admin\AppData\Local\Temp\da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Windows\Windows Update.exe'"
        3⤵
        • Creates scheduled task(s)
        PID:272
      • C:\Users\Admin\Windows\Windows Update.exe
        "C:\Users\Admin\Windows\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Users\Admin\Windows\Windows Update.exe
          "C:\Users\Admin\Windows\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Windows\Windows Update.exe

    Filesize

    339KB

    MD5

    e456517631e88d6c617afcaf827a95c9

    SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

    SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

    SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • C:\Users\Admin\Windows\Windows Update.exe

    Filesize

    339KB

    MD5

    e456517631e88d6c617afcaf827a95c9

    SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

    SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

    SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • C:\Users\Admin\Windows\Windows Update.exe

    Filesize

    339KB

    MD5

    e456517631e88d6c617afcaf827a95c9

    SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

    SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

    SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • \Users\Admin\Windows\Windows Update.exe

    Filesize

    339KB

    MD5

    e456517631e88d6c617afcaf827a95c9

    SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

    SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

    SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • \Users\Admin\Windows\Windows Update.exe

    Filesize

    339KB

    MD5

    e456517631e88d6c617afcaf827a95c9

    SHA1

    6d8bd9818a2b5ea6b2f3ddd2453ae6df3cedac67

    SHA256

    da5b0c44c3c33a911038c54ec26d4357f48779b3562dd6afb16e51cd16547c5d

    SHA512

    d5d7c7b3639b421b146ef10c776b89eff927eb1af89c5d033f76c5341dc1a575ea830d2a6884a04ccbdef2edd24ac0311a4fff86329a5035adb31b9f3b843c5b

  • memory/272-66-0x0000000000000000-mapping.dmp

  • memory/1196-79-0x0000000000408D5E-mapping.dmp

  • memory/1748-72-0x0000000000B70000-0x0000000000BCA000-memory.dmp

    Filesize

    360KB

  • memory/1748-69-0x0000000000000000-mapping.dmp

  • memory/1796-59-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1796-67-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

    Filesize

    8KB

  • memory/1796-65-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1796-63-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1796-61-0x0000000000408D5E-mapping.dmp

  • memory/1796-60-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1796-57-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1796-56-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2000-54-0x0000000000B50000-0x0000000000BAA000-memory.dmp

    Filesize

    360KB

  • memory/2000-55-0x0000000000380000-0x0000000000388000-memory.dmp

    Filesize

    32KB