Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 22:32
Behavioral task
behavioral1
Sample
cdfc36ba42665419295b0c68dde39430.exe
Resource
win7-20230831-en
General
-
Target
cdfc36ba42665419295b0c68dde39430.exe
-
Size
25KB
-
MD5
cdfc36ba42665419295b0c68dde39430
-
SHA1
6b577e002d35133a846ef05fe03b5b250c37e8d4
-
SHA256
f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
-
SHA512
6f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454
-
SSDEEP
384:CB+Sbj6NKwSs6/DAH92Xyh34EnWb5j4kDhlzCTJEUmNYEYQro3lch1Fnsjr:4pwP6/Dw9FaE+RHtN8i1ej
Malware Config
Extracted
limerat
-
aes_key
adlan
-
antivm
false
-
c2_url
https://pastebin.com/raw/EsJXyyQv
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Svchost.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Schost\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/EsJXyyQv
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2916 Svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2208 cdfc36ba42665419295b0c68dde39430.exe 2208 cdfc36ba42665419295b0c68dde39430.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3024 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2916 Svchost.exe Token: SeDebugPrivilege 2916 Svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3024 2208 cdfc36ba42665419295b0c68dde39430.exe 29 PID 2208 wrote to memory of 3024 2208 cdfc36ba42665419295b0c68dde39430.exe 29 PID 2208 wrote to memory of 3024 2208 cdfc36ba42665419295b0c68dde39430.exe 29 PID 2208 wrote to memory of 3024 2208 cdfc36ba42665419295b0c68dde39430.exe 29 PID 2208 wrote to memory of 2916 2208 cdfc36ba42665419295b0c68dde39430.exe 31 PID 2208 wrote to memory of 2916 2208 cdfc36ba42665419295b0c68dde39430.exe 31 PID 2208 wrote to memory of 2916 2208 cdfc36ba42665419295b0c68dde39430.exe 31 PID 2208 wrote to memory of 2916 2208 cdfc36ba42665419295b0c68dde39430.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdfc36ba42665419295b0c68dde39430.exe"C:\Users\Admin\AppData\Local\Temp\cdfc36ba42665419295b0c68dde39430.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Schost\Svchost.exe'"2⤵
- Creates scheduled task(s)
PID:3024
-
-
C:\Users\Admin\AppData\Roaming\Schost\Svchost.exe"C:\Users\Admin\AppData\Roaming\Schost\Svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
25KB
MD5cdfc36ba42665419295b0c68dde39430
SHA16b577e002d35133a846ef05fe03b5b250c37e8d4
SHA256f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
SHA5126f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454
-
Filesize
25KB
MD5cdfc36ba42665419295b0c68dde39430
SHA16b577e002d35133a846ef05fe03b5b250c37e8d4
SHA256f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
SHA5126f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454
-
Filesize
25KB
MD5cdfc36ba42665419295b0c68dde39430
SHA16b577e002d35133a846ef05fe03b5b250c37e8d4
SHA256f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
SHA5126f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454
-
Filesize
25KB
MD5cdfc36ba42665419295b0c68dde39430
SHA16b577e002d35133a846ef05fe03b5b250c37e8d4
SHA256f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
SHA5126f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454
-
Filesize
25KB
MD5cdfc36ba42665419295b0c68dde39430
SHA16b577e002d35133a846ef05fe03b5b250c37e8d4
SHA256f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35
SHA5126f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454