Analysis
-
max time kernel
25s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06-01-2024 14:25
General
-
Target
4674e41064471788442b3b712c152414.exe
-
Size
698KB
-
MD5
4674e41064471788442b3b712c152414
-
SHA1
dbcf1543238fb33bd4ef817cda8148a8e2118375
-
SHA256
542c835beecdb583d91729b609d49a1e9e6072dce2148701faaa356723d241be
-
SHA512
84132c2ff04e50f04993d0ceb6ed2618b80d22cf5fc5e5bf4d6dcbe6fd3d5ead30dba2951c0df9dab392b1c96c1463114fe9bb98fd13e1bc4009ac6f5ab1ed5d
-
SSDEEP
12288:zkIUeiG2E73BzHjyOyHpBvygTUxieU66yI8ku/z0xast:lypBvygA8eU66yfgEst
Malware Config
Extracted
limerat
1NCY4zKfbzBA6apXnRcp4SEPaZc1xeYtzi
-
aes_key
NYANCAT
-
antivm
false
-
c2_url
https://pastebin.com/raw/LJe9sUk5
-
delay
6
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Extracted
warzonerat
businessdministration.webredirect.org:5292
Extracted
njrat
0.7.3
OfficeH
virtuallogoprepaidmax.duckdns.org:6527
Client.exe
-
reg_key
Client.exe
-
splitter
1904
Signatures
-
Detect Neshta payload 7 IoCs
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Warzone RAT payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4674e41064471788442b3b712c152414.exe"C:\Users\Admin\AppData\Local\Temp\4674e41064471788442b3b712c152414.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Updates\Updates.exe"C:\Users\Admin\AppData\Local\Updates\Updates.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\windows\Skype LimeHackRat.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\windows\Skype LimeHackRat.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Updates\Updates.exe"C:\Users\Admin\AppData\Local\Updates\Updates.exe"3⤵
-
-
C:\Windows\services\file.exe"C:\Windows\services\file.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Updates.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Updates.exeC:\Users\Admin\AppData\Local\Temp\Updates.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\file.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\file.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Updates.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Updates.exeC:\Users\Admin\AppData\Local\Temp\Updates.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD50b7997243e297cc1b4a062855004d120
SHA15b8f2cf40ceea8e360c20044ee99b5e772fef55b
SHA2564a89962e0e05bf38bac67e3dd8a975b6286baf928fa5eb40cf287a6619dff37f
SHA512c06dd69c6d621c2e2a9c70c55c86f018577625d8c9ff2776e6ad8a9b003df1ce21cfb8c47b2abd0e3a3843b4495d90b3a18cc4a014fe598c8fd6aa2ad8c1351f
-
Filesize
698KB
MD54674e41064471788442b3b712c152414
SHA1dbcf1543238fb33bd4ef817cda8148a8e2118375
SHA256542c835beecdb583d91729b609d49a1e9e6072dce2148701faaa356723d241be
SHA51284132c2ff04e50f04993d0ceb6ed2618b80d22cf5fc5e5bf4d6dcbe6fd3d5ead30dba2951c0df9dab392b1c96c1463114fe9bb98fd13e1bc4009ac6f5ab1ed5d
-
Filesize
381KB
MD5dc950dcdf6ff43ffaf85fab2945f9837
SHA1ee8d8bedfb63759269413bf4e4a54a499860f685
SHA256853ecd633c1f53f24d19c30f56c537552010ec99c1b3f7bbf5e89ce3d21a75b0
SHA512874e88aeecd317615ed124523a63e491f892c7ab4d5b0bb9b98cee8e9bdc18bbb6e0ee2e87fb0244841ae8ddeb8e2d456fa1193f1a461fd0467793c520702bfc
-
Filesize
180KB
MD58f76cd22d7334c6b8101cd2766230ed5
SHA132a617ab8f1a508710581726fcce748cf5ed8923
SHA256aa229f3b7f5b944598cb903664ba1aa8764d8670b2dffcc5bbdfd18e20a7d8b1
SHA512fa7ec8866542fd769fbb378e9b7e243db89627ea3bdb95a69aeaa545248aad7c7603511eba1b186e5273d763adfbbe2cddf93a30446120c29d2bc06f2b947639
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
160KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
720KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
104KB