Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
04-09-2023 01:21
General
-
Target
1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exe
-
Size
1.5MB
-
MD5
4c6675bcb4996241e68fd4ac2fad45c2
-
SHA1
e62124ae24bc980199900e5a7c392191882118cc
-
SHA256
1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b
-
SHA512
bf385448e4791a67e6fd79cc2310835320c7c590e95d2933eb661a5fd41712f8f6d3760410d733757effc08da32160b58909b14f8eb295b68594efa885542ab9
-
SSDEEP
24576:C4Zv8wgIQYygkY9lA6pnLZGBrgxFdgLOjRFqD3Fd2U+1A4EKazGG7/52rhUVrp:CkYIhkeTYBrUyOjjU+1ArF/El+9
Malware Config
Extracted
limerat
1B5aLZh6psoQttLGn9tpbdibiWqzyh4Jfv
-
aes_key
NYANCAT
-
antivm
false
-
c2_url
https://pastebin.com/raw/LJe9sUk5
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/LJe9sUk5
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
-
Suspicious use of FindShellTrayWindow 49 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exe"C:\Users\Admin\AppData\Local\Temp\1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14982.exe"C:\Users\Admin\AppData\Local\Temp\14982.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exeC:\Users\Admin\AppData\Local\Temp\1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b' -Value '"C:\Users\Admin\AppData\Local\Temp\1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2744 -s 38642⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 448 -p 2744 -ip 27441⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2360 -s 36202⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 2360 -ip 23601⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4556 -s 35802⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4556 -ip 45561⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2960 -s 35802⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 2960 -ip 29601⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4864 -s 35802⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 4864 -ip 48641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1017B
MD512ded5fc42db36da39ee40506fa984b9
SHA14a8f204796d3c19eb014b44a8c8fc3db8d837ca8
SHA25675e2ed5aeaff63200f0c0fc5acb5f7658393f991ba276091119cd45e91b91817
SHA51292e54c4ec2684269432346b4a586c8b52e20305493dcbc8760cdb5986e9698595c8096b10013ddb4ad31d9779a76c511ded54e541c224c686f1c4b391b41413e
-
Filesize
97B
MD5ebeebc289a415534fff0bdd529e53a92
SHA1634e5c7676c7639ddc4968b84d523506fc6929d8
SHA25686b8c269bd0cd5e06755107130488cf1b1813c009ce7f2f42907be89e3dbe85a
SHA512c07b33162f45da9fba974c19c718aad4d0eae384e0ee5271a240648628e4e137a28bdc6dc76e800559fae300c205c939ce041a91f183e433aa60a40258237be4
-
Filesize
75KB
MD5acfca62b955f4a76968c3a8d4e9de625
SHA162af8f5b8d1761c535dc6bf45e72ae532b502e0c
SHA256ee07972ab3acd4def5e842dab0c8827dd8799faf5f5c80c407718ffe862fef8f
SHA5120f7cd9c5e0c607d28178c7ed561ecfdd52930885a4dce552009b932b162ff87d86a242c94469685a476bd0262066a415d13f45ff62f9d5ebd0e8533468e1519b
-
Filesize
75KB
MD5acfca62b955f4a76968c3a8d4e9de625
SHA162af8f5b8d1761c535dc6bf45e72ae532b502e0c
SHA256ee07972ab3acd4def5e842dab0c8827dd8799faf5f5c80c407718ffe862fef8f
SHA5120f7cd9c5e0c607d28178c7ed561ecfdd52930885a4dce552009b932b162ff87d86a242c94469685a476bd0262066a415d13f45ff62f9d5ebd0e8533468e1519b
-
Filesize
97B
MD5ebeebc289a415534fff0bdd529e53a92
SHA1634e5c7676c7639ddc4968b84d523506fc6929d8
SHA25686b8c269bd0cd5e06755107130488cf1b1813c009ce7f2f42907be89e3dbe85a
SHA512c07b33162f45da9fba974c19c718aad4d0eae384e0ee5271a240648628e4e137a28bdc6dc76e800559fae300c205c939ce041a91f183e433aa60a40258237be4
-
Filesize
97B
MD5ebeebc289a415534fff0bdd529e53a92
SHA1634e5c7676c7639ddc4968b84d523506fc6929d8
SHA25686b8c269bd0cd5e06755107130488cf1b1813c009ce7f2f42907be89e3dbe85a
SHA512c07b33162f45da9fba974c19c718aad4d0eae384e0ee5271a240648628e4e137a28bdc6dc76e800559fae300c205c939ce041a91f183e433aa60a40258237be4
-
Filesize
97B
MD5ebeebc289a415534fff0bdd529e53a92
SHA1634e5c7676c7639ddc4968b84d523506fc6929d8
SHA25686b8c269bd0cd5e06755107130488cf1b1813c009ce7f2f42907be89e3dbe85a
SHA512c07b33162f45da9fba974c19c718aad4d0eae384e0ee5271a240648628e4e137a28bdc6dc76e800559fae300c205c939ce041a91f183e433aa60a40258237be4
-
Filesize
97B
MD5ebeebc289a415534fff0bdd529e53a92
SHA1634e5c7676c7639ddc4968b84d523506fc6929d8
SHA25686b8c269bd0cd5e06755107130488cf1b1813c009ce7f2f42907be89e3dbe85a
SHA512c07b33162f45da9fba974c19c718aad4d0eae384e0ee5271a240648628e4e137a28bdc6dc76e800559fae300c205c939ce041a91f183e433aa60a40258237be4
-
Filesize
28KB
MD522df9b6c3a71b8dbbdef5d5bd09e445f
SHA10fdb02616c74e6eca4535d7b160a2e16a3e79943
SHA256024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e
SHA5122ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3
-
Filesize
28KB
MD522df9b6c3a71b8dbbdef5d5bd09e445f
SHA10fdb02616c74e6eca4535d7b160a2e16a3e79943
SHA256024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e
SHA5122ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3
-
Filesize
28KB
MD522df9b6c3a71b8dbbdef5d5bd09e445f
SHA10fdb02616c74e6eca4535d7b160a2e16a3e79943
SHA256024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e
SHA5122ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1024KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
7.7MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
7.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
7.7MB
-
Filesize
688KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
48KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
216KB