Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
22-04-2023 01:12
General
-
Target
6d28fe68df58ab9121992fdcfba660bac50108c9ea9fd786a8dc3611b4f60289.exe
-
Size
28KB
-
MD5
22c74adf03e49db1dfab9216566d4ed9
-
SHA1
7b0f06fe3512717632b943be8ca3445e915f62d2
-
SHA256
6d28fe68df58ab9121992fdcfba660bac50108c9ea9fd786a8dc3611b4f60289
-
SHA512
b9bd0ecb294c192e2b235a51397c3157617d2a59f60bd533ff59a9a33b6e7d3140585e9c725a685f04006d7d122ca301f40cc62301527d34eb99a5bcbc13b55d
-
SSDEEP
384:7B+Sbj6NKZYvR62u3AHtIEUqDXOe+y14vDKNrCeJE3WNgPe5FtosBAzQro3lcBGQ:lpZYZ62u3wtzOe+2W45NdisBeuj
Score
10/10
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
4545
-
antivm
false
-
c2_url
https://pastebin.com/raw/rTiY1HLu
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d28fe68df58ab9121992fdcfba660bac50108c9ea9fd786a8dc3611b4f60289.exe"C:\Users\Admin\AppData\Local\Temp\6d28fe68df58ab9121992fdcfba660bac50108c9ea9fd786a8dc3611b4f60289.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
256KB