Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 14:09
Static task
static1
Behavioral task
behavioral1
Sample
c23d849b84bb757dc19ccd19a7c7c6c1.exe
Resource
win7-20231215-en
General
-
Target
c23d849b84bb757dc19ccd19a7c7c6c1.exe
-
Size
64KB
-
MD5
c23d849b84bb757dc19ccd19a7c7c6c1
-
SHA1
6f0eaa46dbfe8a7ff5596414118c0ba52a64b16d
-
SHA256
8b81b385a2646033343216dcdfd40463b127f36a0708dfcdc189e571d2add35f
-
SHA512
a16195078aad21dc47fe48ed514612dcc6af4e39fc2680d7095b2105a3fb9856e0022ab448a0a150b80167204d58f7d74c29793e9de1f31ef23f742650ce28c8
-
SSDEEP
768:cWvDGHFPHc5b3U+KOT/NO1lgA9SkuTdIbf+iK6shRoJv0wtVbG+HdyJW5wmy3OOP:cZlPg3U+jT+KGq6shR8vHD5wi4OOP
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/NzAFK8As
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2568 WindowsServices.exe -
Loads dropped DLL 2 IoCs
pid Process 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2856 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2568 WindowsServices.exe Token: SeDebugPrivilege 2568 WindowsServices.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2856 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 29 PID 3040 wrote to memory of 2856 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 29 PID 3040 wrote to memory of 2856 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 29 PID 3040 wrote to memory of 2856 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 29 PID 3040 wrote to memory of 2568 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 31 PID 3040 wrote to memory of 2568 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 31 PID 3040 wrote to memory of 2568 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 31 PID 3040 wrote to memory of 2568 3040 c23d849b84bb757dc19ccd19a7c7c6c1.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23d849b84bb757dc19ccd19a7c7c6c1.exe"C:\Users\Admin\AppData\Local\Temp\c23d849b84bb757dc19ccd19a7c7c6c1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Sys\WindowsServices.exe'"2⤵
- Creates scheduled task(s)
PID:2856
-
-
C:\Users\Admin\Sys\WindowsServices.exe"C:\Users\Admin\Sys\WindowsServices.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
64KB
MD5c23d849b84bb757dc19ccd19a7c7c6c1
SHA16f0eaa46dbfe8a7ff5596414118c0ba52a64b16d
SHA2568b81b385a2646033343216dcdfd40463b127f36a0708dfcdc189e571d2add35f
SHA512a16195078aad21dc47fe48ed514612dcc6af4e39fc2680d7095b2105a3fb9856e0022ab448a0a150b80167204d58f7d74c29793e9de1f31ef23f742650ce28c8