Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 21:48
Static task
static1
Behavioral task
behavioral1
Sample
ab9cdcc91e38013c926be73428f7d03b.exe
Resource
win7-20231215-en
General
-
Target
ab9cdcc91e38013c926be73428f7d03b.exe
-
Size
97KB
-
MD5
ab9cdcc91e38013c926be73428f7d03b
-
SHA1
d2e5d604eec7b39aa844930264c13109f425e9f1
-
SHA256
e19090ef03d3b2617e1409f23fc768d590f31859e53d9f60baa6d9109ecac6b3
-
SHA512
ac46ae3320074ad34b01ef96787199c9be88bcffc90d9da14dc5104026c2356851a4b6ecde90ae5eea8037a46476862f44ead0c4f0a0c3691c760dcf836d5074
-
SSDEEP
1536:uZC69+uI2AwnGWPp6WnriJ460TBkfFBNRkb+9VpaPbMMkpSJwT1hFyX:uG2AWGC6aA0TBkNB3S+9VLZSJI1hFC
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/NzAFK8As
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation ab9cdcc91e38013c926be73428f7d03b.exe -
Executes dropped EXE 1 IoCs
pid Process 4848 WindowsServices.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3252 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4848 WindowsServices.exe Token: SeDebugPrivilege 4848 WindowsServices.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4248 wrote to memory of 3252 4248 ab9cdcc91e38013c926be73428f7d03b.exe 95 PID 4248 wrote to memory of 3252 4248 ab9cdcc91e38013c926be73428f7d03b.exe 95 PID 4248 wrote to memory of 3252 4248 ab9cdcc91e38013c926be73428f7d03b.exe 95 PID 4248 wrote to memory of 4848 4248 ab9cdcc91e38013c926be73428f7d03b.exe 96 PID 4248 wrote to memory of 4848 4248 ab9cdcc91e38013c926be73428f7d03b.exe 96 PID 4248 wrote to memory of 4848 4248 ab9cdcc91e38013c926be73428f7d03b.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9cdcc91e38013c926be73428f7d03b.exe"C:\Users\Admin\AppData\Local\Temp\ab9cdcc91e38013c926be73428f7d03b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Sys\WindowsServices.exe'"2⤵
- Creates scheduled task(s)
PID:3252
-
-
C:\Users\Admin\Sys\WindowsServices.exe"C:\Users\Admin\Sys\WindowsServices.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5ab9cdcc91e38013c926be73428f7d03b
SHA1d2e5d604eec7b39aa844930264c13109f425e9f1
SHA256e19090ef03d3b2617e1409f23fc768d590f31859e53d9f60baa6d9109ecac6b3
SHA512ac46ae3320074ad34b01ef96787199c9be88bcffc90d9da14dc5104026c2356851a4b6ecde90ae5eea8037a46476862f44ead0c4f0a0c3691c760dcf836d5074