Analysis
-
max time kernel
50s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31-12-2023 06:23
General
-
Target
2b9c865fd057f370f77e5f2e96922088.exe
-
Size
717KB
-
MD5
2b9c865fd057f370f77e5f2e96922088
-
SHA1
3dc962377b0937fec1f10f6ac585e75e6bab92e0
-
SHA256
72b8deec4c725fa64676fc74a84ad2426ddee89a3b3c8bb00073ef10514ddb9f
-
SHA512
e5e4e5aaec72c76926ca1c27856af07131b7d6c348c99481b8f2e1cf9960ed5a4826dffa2394cdbeec91cd8a7dd9a1eebf55c09871180d0e6564c764c1a0e351
-
SSDEEP
12288:25WafCzLOmE6+/QkvRklicBbRVjoq8OUXD7Wp/qwYnwnTRVY8I4J2pbFpe+FHAqg:CzfCHzD+/BRkUzEvp/N
Malware Config
Extracted
limerat
bc1qdajqyl8uarnz63e2we9xchx3zqcd5xcyfshfyk
-
aes_key
lime
-
antivm
true
-
c2_url
https://pastebin.com/raw/4Xj3extx
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9c865fd057f370f77e5f2e96922088.exe"C:\Users\Admin\AppData\Local\Temp\2b9c865fd057f370f77e5f2e96922088.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2b9c865fd057f370f77e5f2e96922088.exe"C:\Users\Admin\AppData\Local\Temp\2b9c865fd057f370f77e5f2e96922088.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Wservices.exe"C:\Users\Admin\AppData\Local\Temp\Wservices.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Wservices.exe"C:\Users\Admin\AppData\Local\Temp\Wservices.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RzeNqlO.exe"4⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RzeNqlO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5BF.tmp"4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wservices.exe"4⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RzeNqlO.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RzeNqlO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5B4.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RzeNqlO.exe"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2b9c865fd057f370f77e5f2e96922088.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52b1f36137675c0d1c8599b2469ee679e
SHA15cc7c52ed7371bbf91ed1923e30039e9264ca22f
SHA25629485e2ba2a6a92257f7c24ab2efdac8b481531b5cec411bbafee70d0a356af1
SHA512445f60fd65f24a00d973c9bcd3971c578b85f58374a8ff719b2fdc21877851d3081d048f9bcfa6ec4779dd921c4bc4e89f14b172b65b7d9d041670a311d23458
-
Filesize
7KB
MD5cbd3d8c3899c6519946b2a76a96a8942
SHA1d6b744f148fdd82333e5be1ca9fe569bf29020f4
SHA2567d8da82335bb0593466d90de308de2a6abbe5a15fcf56f9fc3508510441dad95
SHA512c0f2addba473069e66571e41b860d588983b81b6b0332bdb9a4e61bed5e75f87fb348526f17bb20efca87a1f869a6afd01b11acfc115d0b8db115842690fe70f
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
520KB
-
Filesize
56KB
-
Filesize
744KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
744KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB