Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 19:26
Behavioral task
behavioral1
Sample
80aabd5337136686aefe2ff1e6da8d5a.exe
Resource
win7-20231215-en
General
-
Target
80aabd5337136686aefe2ff1e6da8d5a.exe
-
Size
563KB
-
MD5
80aabd5337136686aefe2ff1e6da8d5a
-
SHA1
a749d303f5a928cff0d66ac23a704b90837ea0f9
-
SHA256
afd7b91be42e614fa8f3488f8cf2024b1a5b364c4b66c514fa86940b06c93515
-
SHA512
5472e503c6e18297efcac3cb0b78dd1c4798f6d60695bf738aba8cfdf42902a2b9d5fb0bf35503750efd6a31ea1cb0144fa07f3f31aeaaee8bd492c0a501fe5a
-
SSDEEP
12288:6V6zPygCa+DZjF1/A/ZMvGTsv+wD1IRJ+ZN1JBCGoOdnq1T:c6zPXCa+DZj3/SOvPGkZ13ox
Malware Config
Extracted
limerat
False
-
aes_key
admin12345$
-
antivm
false
-
c2_url
https://pastebin.com/raw/dd1yrjpH
-
download_payload
false
-
install
false
-
install_name
settings.exe
-
main_folder
False
-
payload_url
True
-
pin_spread
false
-
sub_folder
True
-
usb_spread
false
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/3468-0-0x000002C3BC6D0000-0x000002C3BC762000-memory.dmp disable_win_def C:\ProgramData\Provisioning\settings.exe disable_win_def -
Drops file in Drivers directory 1 IoCs
Processes:
settings.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts settings.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
80aabd5337136686aefe2ff1e6da8d5a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 80aabd5337136686aefe2ff1e6da8d5a.exe -
Executes dropped EXE 1 IoCs
Processes:
settings.exepid process 2512 settings.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
80aabd5337136686aefe2ff1e6da8d5a.exesettings.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini 80aabd5337136686aefe2ff1e6da8d5a.exe File opened for modification C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini 80aabd5337136686aefe2ff1e6da8d5a.exe File created C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini settings.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4328 schtasks.exe 1272 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
80aabd5337136686aefe2ff1e6da8d5a.exesettings.exepid process 3468 80aabd5337136686aefe2ff1e6da8d5a.exe 3468 80aabd5337136686aefe2ff1e6da8d5a.exe 3468 80aabd5337136686aefe2ff1e6da8d5a.exe 2512 settings.exe 2512 settings.exe 2512 settings.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
80aabd5337136686aefe2ff1e6da8d5a.exesettings.exedescription pid process Token: SeDebugPrivilege 3468 80aabd5337136686aefe2ff1e6da8d5a.exe Token: SeDebugPrivilege 2512 settings.exe Token: SeDebugPrivilege 2512 settings.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
80aabd5337136686aefe2ff1e6da8d5a.execmd.exesettings.execmd.exedescription pid process target process PID 3468 wrote to memory of 4328 3468 80aabd5337136686aefe2ff1e6da8d5a.exe schtasks.exe PID 3468 wrote to memory of 4328 3468 80aabd5337136686aefe2ff1e6da8d5a.exe schtasks.exe PID 3468 wrote to memory of 4816 3468 80aabd5337136686aefe2ff1e6da8d5a.exe cmd.exe PID 3468 wrote to memory of 4816 3468 80aabd5337136686aefe2ff1e6da8d5a.exe cmd.exe PID 4816 wrote to memory of 2556 4816 cmd.exe attrib.exe PID 4816 wrote to memory of 2556 4816 cmd.exe attrib.exe PID 4816 wrote to memory of 1108 4816 cmd.exe attrib.exe PID 4816 wrote to memory of 1108 4816 cmd.exe attrib.exe PID 3468 wrote to memory of 2512 3468 80aabd5337136686aefe2ff1e6da8d5a.exe settings.exe PID 3468 wrote to memory of 2512 3468 80aabd5337136686aefe2ff1e6da8d5a.exe settings.exe PID 2512 wrote to memory of 1272 2512 settings.exe schtasks.exe PID 2512 wrote to memory of 1272 2512 settings.exe schtasks.exe PID 2512 wrote to memory of 536 2512 settings.exe cmd.exe PID 2512 wrote to memory of 536 2512 settings.exe cmd.exe PID 536 wrote to memory of 2080 536 cmd.exe attrib.exe PID 536 wrote to memory of 2080 536 cmd.exe attrib.exe PID 536 wrote to memory of 640 536 cmd.exe attrib.exe PID 536 wrote to memory of 640 536 cmd.exe attrib.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 4 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exepid process 2080 attrib.exe 640 attrib.exe 2556 attrib.exe 1108 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80aabd5337136686aefe2ff1e6da8d5a.exe"C:\Users\Admin\AppData\Local\Temp\80aabd5337136686aefe2ff1e6da8d5a.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL LIMITED /tn UDMR /tr "'C:\ProgramData\Provisioning\settings.exe'"2⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\cmd.execmd /c attrib +H +S "C:\ProgramData\\Provisioning" & attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\ProgramData\\Provisioning"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\ProgramData\\Provisioning\*" /S /D3⤵
- Views/modifies file attributes
-
C:\ProgramData\Provisioning\settings.exe"C:\ProgramData\Provisioning\settings.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL LIMITED /tn UDMR /tr "'C:\ProgramData\Provisioning\settings.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\cmd.execmd /c attrib +H +S "C:\ProgramData\\Provisioning" & attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\ProgramData\\Provisioning"4⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\ProgramData\\Provisioning\*" /S /D4⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Provisioning\settings.exeFilesize
563KB
MD580aabd5337136686aefe2ff1e6da8d5a
SHA1a749d303f5a928cff0d66ac23a704b90837ea0f9
SHA256afd7b91be42e614fa8f3488f8cf2024b1a5b364c4b66c514fa86940b06c93515
SHA5125472e503c6e18297efcac3cb0b78dd1c4798f6d60695bf738aba8cfdf42902a2b9d5fb0bf35503750efd6a31ea1cb0144fa07f3f31aeaaee8bd492c0a501fe5a
-
C:\Users\Admin\AppData\Roaming\LinkM\settings.exe.lnkFilesize
802B
MD561faad8199c2e47ad6ba3d7ead81f6d6
SHA17e56e8fe3d37301a33d4ded81296d3b76d350612
SHA25602b094328475ed462d69d66b66801807dc76aecee00f50526d6a27363a658ab3
SHA512b13aa3ba23b9b6af965b7bf21d3e0579c92b5897f8512ef9de04321d01f9b61e97476eb2e7761aba4d0f3d9d852912c26d7a3699481de2cf0d16a5b26ba56dfe
-
memory/2512-10-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmpFilesize
10.8MB
-
memory/2512-13-0x000002242A780000-0x000002242A790000-memory.dmpFilesize
64KB
-
memory/2512-14-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmpFilesize
10.8MB
-
memory/3468-0-0x000002C3BC6D0000-0x000002C3BC762000-memory.dmpFilesize
584KB
-
memory/3468-1-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmpFilesize
10.8MB
-
memory/3468-6-0x000002C3D6CB0000-0x000002C3D6CC0000-memory.dmpFilesize
64KB
-
memory/3468-9-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmpFilesize
10.8MB