Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2024 19:26

General

  • Target

    80aabd5337136686aefe2ff1e6da8d5a.exe

  • Size

    563KB

  • MD5

    80aabd5337136686aefe2ff1e6da8d5a

  • SHA1

    a749d303f5a928cff0d66ac23a704b90837ea0f9

  • SHA256

    afd7b91be42e614fa8f3488f8cf2024b1a5b364c4b66c514fa86940b06c93515

  • SHA512

    5472e503c6e18297efcac3cb0b78dd1c4798f6d60695bf738aba8cfdf42902a2b9d5fb0bf35503750efd6a31ea1cb0144fa07f3f31aeaaee8bd492c0a501fe5a

  • SSDEEP

    12288:6V6zPygCa+DZjF1/A/ZMvGTsv+wD1IRJ+ZN1JBCGoOdnq1T:c6zPXCa+DZj3/SOvPGkZ13ox

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

False

Attributes
  • aes_key

    admin12345$

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/dd1yrjpH

  • download_payload

    false

  • install

    false

  • install_name

    settings.exe

  • main_folder

    False

  • payload_url

    True

  • pin_spread

    false

  • sub_folder

    True

  • usb_spread

    false

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80aabd5337136686aefe2ff1e6da8d5a.exe
    "C:\Users\Admin\AppData\Local\Temp\80aabd5337136686aefe2ff1e6da8d5a.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /f /sc MINUTE /mo 5 /RL LIMITED /tn UDMR /tr "'C:\ProgramData\Provisioning\settings.exe'"
      2⤵
      • Creates scheduled task(s)
      PID:4328
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c attrib +H +S "C:\ProgramData\\Provisioning" & attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\system32\attrib.exe
        attrib +H +S "C:\ProgramData\\Provisioning"
        3⤵
        • Views/modifies file attributes
        PID:2556
      • C:\Windows\system32\attrib.exe
        attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D
        3⤵
        • Views/modifies file attributes
        PID:1108
    • C:\ProgramData\Provisioning\settings.exe
      "C:\ProgramData\Provisioning\settings.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL LIMITED /tn UDMR /tr "'C:\ProgramData\Provisioning\settings.exe'"
        3⤵
        • Creates scheduled task(s)
        PID:1272
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c attrib +H +S "C:\ProgramData\\Provisioning" & attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\system32\attrib.exe
          attrib +H +S "C:\ProgramData\\Provisioning"
          4⤵
          • Views/modifies file attributes
          PID:2080
        • C:\Windows\system32\attrib.exe
          attrib +H +S "C:\ProgramData\\Provisioning\*" /S /D
          4⤵
          • Views/modifies file attributes
          PID:640

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Provisioning\settings.exe
    Filesize

    563KB

    MD5

    80aabd5337136686aefe2ff1e6da8d5a

    SHA1

    a749d303f5a928cff0d66ac23a704b90837ea0f9

    SHA256

    afd7b91be42e614fa8f3488f8cf2024b1a5b364c4b66c514fa86940b06c93515

    SHA512

    5472e503c6e18297efcac3cb0b78dd1c4798f6d60695bf738aba8cfdf42902a2b9d5fb0bf35503750efd6a31ea1cb0144fa07f3f31aeaaee8bd492c0a501fe5a

  • C:\Users\Admin\AppData\Roaming\LinkM\settings.exe.lnk
    Filesize

    802B

    MD5

    61faad8199c2e47ad6ba3d7ead81f6d6

    SHA1

    7e56e8fe3d37301a33d4ded81296d3b76d350612

    SHA256

    02b094328475ed462d69d66b66801807dc76aecee00f50526d6a27363a658ab3

    SHA512

    b13aa3ba23b9b6af965b7bf21d3e0579c92b5897f8512ef9de04321d01f9b61e97476eb2e7761aba4d0f3d9d852912c26d7a3699481de2cf0d16a5b26ba56dfe

  • memory/2512-10-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmp
    Filesize

    10.8MB

  • memory/2512-13-0x000002242A780000-0x000002242A790000-memory.dmp
    Filesize

    64KB

  • memory/2512-14-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmp
    Filesize

    10.8MB

  • memory/3468-0-0x000002C3BC6D0000-0x000002C3BC762000-memory.dmp
    Filesize

    584KB

  • memory/3468-1-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmp
    Filesize

    10.8MB

  • memory/3468-6-0x000002C3D6CB0000-0x000002C3D6CC0000-memory.dmp
    Filesize

    64KB

  • memory/3468-9-0x00007FFAF99C0000-0x00007FFAFA481000-memory.dmp
    Filesize

    10.8MB