Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
08750B4BBC8A34A3F7E12BB6F9A71444.exe
Resource
win7-20231215-en
General
-
Target
08750B4BBC8A34A3F7E12BB6F9A71444.exe
-
Size
28KB
-
MD5
08750b4bbc8a34a3f7e12bb6f9a71444
-
SHA1
400f42a7a1c9d7486ad7d07200a5a2908d71d231
-
SHA256
7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3
-
SHA512
81b25e17299f11b8487df0914471f85786d30983f87640eb6b4bbda2a21257a675085c32395694a49d00f8d7d0e01705a06f870c4d7729159fd0d62ed2eac5f0
-
SSDEEP
384:s/rLhJcl6QdgPxVHGhOaZJTGPuFW9vcCZjgD0kau3GXsW7ltIpjIhvGyvN9:s/rLhufgPhaumCvcvDauCWjIhvr
Malware Config
Extracted
limerat
-
aes_key
NKHUB
-
antivm
true
-
c2_url
https://pastebin.com/raw/K6zz3eth
-
delay
3
-
download_payload
false
-
install
true
-
install_name
svchost.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\OdlaçddApdad\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/K6zz3eth
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 08750B4BBC8A34A3F7E12BB6F9A71444.exe -
Executes dropped EXE 1 IoCs
pid Process 4988 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2328 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4988 svchost.exe Token: SeDebugPrivilege 4988 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4540 wrote to memory of 2328 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 92 PID 4540 wrote to memory of 2328 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 92 PID 4540 wrote to memory of 2328 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 92 PID 4540 wrote to memory of 4988 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 94 PID 4540 wrote to memory of 4988 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 94 PID 4540 wrote to memory of 4988 4540 08750B4BBC8A34A3F7E12BB6F9A71444.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\08750B4BBC8A34A3F7E12BB6F9A71444.exe"C:\Users\Admin\AppData\Local\Temp\08750B4BBC8A34A3F7E12BB6F9A71444.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe'"2⤵
- Creates scheduled task(s)
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD508750b4bbc8a34a3f7e12bb6f9a71444
SHA1400f42a7a1c9d7486ad7d07200a5a2908d71d231
SHA2567e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3
SHA51281b25e17299f11b8487df0914471f85786d30983f87640eb6b4bbda2a21257a675085c32395694a49d00f8d7d0e01705a06f870c4d7729159fd0d62ed2eac5f0