Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2023, 22:05
Behavioral task
behavioral1
Sample
e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe
Resource
win7-20221111-en
General
-
Target
e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe
-
Size
46KB
-
MD5
abe4ff36c8c3a6cb420fd3fabf0df23f
-
SHA1
eada417aebe70a6b002f5d4244366fc6ad579000
-
SHA256
e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c
-
SHA512
c056f5a7c9ad5a2e8af116438ce8b861b1da69ed2d13ab3ea46407e064e9cd680e2d716d473f951e3ee9f79a730d21ed6e2663ef3aab25396cf8c92d2561e39b
-
SSDEEP
768:UpCu6vzwdlWN8hOY45NVg1UWj/eb3AsMtY7eb3AsMt:Up6zwdQNbl50CTA/YqTA/
Malware Config
Extracted
limerat
-
aes_key
1478967
-
antivm
false
-
c2_url
https://pastebin.com/raw/Afe0QGiz
-
delay
3
-
download_payload
false
-
install
true
-
install_name
ApplicationFrameHost.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3048 LocaljRhkoiqAvJ.exe 3924 ApplicationFrameHost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation LocaljRhkoiqAvJ.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4928 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3924 ApplicationFrameHost.exe Token: SeDebugPrivilege 3924 ApplicationFrameHost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4604 wrote to memory of 3048 4604 e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe 81 PID 4604 wrote to memory of 3048 4604 e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe 81 PID 4604 wrote to memory of 3048 4604 e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe 81 PID 3048 wrote to memory of 4928 3048 LocaljRhkoiqAvJ.exe 82 PID 3048 wrote to memory of 4928 3048 LocaljRhkoiqAvJ.exe 82 PID 3048 wrote to memory of 4928 3048 LocaljRhkoiqAvJ.exe 82 PID 3048 wrote to memory of 3924 3048 LocaljRhkoiqAvJ.exe 84 PID 3048 wrote to memory of 3924 3048 LocaljRhkoiqAvJ.exe 84 PID 3048 wrote to memory of 3924 3048 LocaljRhkoiqAvJ.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe"C:\Users\Admin\AppData\Local\Temp\e360c69993aeff3cece090d1ac380c5da51739c4f2a19a0870dde8541afdeb3c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\LocaljRhkoiqAvJ.exe"C:\Users\Admin\AppData\LocaljRhkoiqAvJ.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe'"3⤵
- Creates scheduled task(s)
PID:4928
-
-
C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD57a194546c827246d5e2b9026bd8afd82
SHA145f92f825dea5e2ff350e6f5b6cdf58ca92f559a
SHA256eac21c69bee39ee17252ca5d45e18951df7cff669b4af347567c9d894c672d12
SHA512bf136ca203034a1355e42ac95486b477001eb88a540eb3f116ecbfdd925c98a1cbdd2d0af428d8c5742908fd6da8b33b666fb8c62e5fdb6322924612af21193f
-
Filesize
28KB
MD57a194546c827246d5e2b9026bd8afd82
SHA145f92f825dea5e2ff350e6f5b6cdf58ca92f559a
SHA256eac21c69bee39ee17252ca5d45e18951df7cff669b4af347567c9d894c672d12
SHA512bf136ca203034a1355e42ac95486b477001eb88a540eb3f116ecbfdd925c98a1cbdd2d0af428d8c5742908fd6da8b33b666fb8c62e5fdb6322924612af21193f
-
Filesize
28KB
MD57a194546c827246d5e2b9026bd8afd82
SHA145f92f825dea5e2ff350e6f5b6cdf58ca92f559a
SHA256eac21c69bee39ee17252ca5d45e18951df7cff669b4af347567c9d894c672d12
SHA512bf136ca203034a1355e42ac95486b477001eb88a540eb3f116ecbfdd925c98a1cbdd2d0af428d8c5742908fd6da8b33b666fb8c62e5fdb6322924612af21193f
-
Filesize
28KB
MD57a194546c827246d5e2b9026bd8afd82
SHA145f92f825dea5e2ff350e6f5b6cdf58ca92f559a
SHA256eac21c69bee39ee17252ca5d45e18951df7cff669b4af347567c9d894c672d12
SHA512bf136ca203034a1355e42ac95486b477001eb88a540eb3f116ecbfdd925c98a1cbdd2d0af428d8c5742908fd6da8b33b666fb8c62e5fdb6322924612af21193f