Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    220s
  • max time network
    239s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2023, 19:26

General

  • Target

    3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41.exe

  • Size

    77KB

  • MD5

    0badb1a758031e5ee6aca7e01e551005

  • SHA1

    3b2094e19a8958d16ddd1914c51b55cc1ef46de7

  • SHA256

    3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41

  • SHA512

    a75b7fb8a78704796ad8af2df84a8f9e61fc14255621fe3ac9d4a7364a966362b7a19086eb3502dedb62969bf188475c181e7e99226d34e87f1cceb40e756077

  • SSDEEP

    1536:4FiOpOK7McctSDnAeVB919Z97CXrRkvXE+QQ4k6P8t5W:eZX/eKnLrZXvXE+QQ4k6P8t5W

Malware Config

Extracted

Family

limerat

Wallets

1PwPgp5XGS4VapRjQM1XijgAs2psFeZVGM

Attributes
  • aes_key

    #C^7M3ha6&%678n3VRZet)-D*;zH8Hxa

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/6mZktVr5

  • delay

    35

  • download_payload

    false

  • install

    false

  • install_name

    Windows Update Assistant.exe

  • main_folder

    UserProfile

  • pin_spread

    false

  • sub_folder

    \Microsoft\

  • usb_spread

    true

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41.exe
    "C:\Users\Admin\AppData\Local\Temp\3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41.exe"
    1⤵
    • Looks for VMWare Tools registry key
    • Windows security modification
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41.exe
      "{path}"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41.exe

    Filesize

    77KB

    MD5

    0badb1a758031e5ee6aca7e01e551005

    SHA1

    3b2094e19a8958d16ddd1914c51b55cc1ef46de7

    SHA256

    3fcc4f194e7bc1b894cacb0c09642b9827c9f11ab43180ffcc36ce5c8401bf41

    SHA512

    a75b7fb8a78704796ad8af2df84a8f9e61fc14255621fe3ac9d4a7364a966362b7a19086eb3502dedb62969bf188475c181e7e99226d34e87f1cceb40e756077

  • memory/2472-132-0x0000000000030000-0x000000000004C000-memory.dmp

    Filesize

    112KB

  • memory/2472-133-0x000000000A570000-0x000000000AB14000-memory.dmp

    Filesize

    5.6MB

  • memory/2472-134-0x000000000A0C0000-0x000000000A15C000-memory.dmp

    Filesize

    624KB

  • memory/3772-138-0x00000000003C0000-0x00000000003CC000-memory.dmp

    Filesize

    48KB

  • memory/3772-139-0x0000000004D20000-0x0000000004D86000-memory.dmp

    Filesize

    408KB

  • memory/3772-140-0x0000000006310000-0x00000000063A2000-memory.dmp

    Filesize

    584KB