Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 17:39
Behavioral task
behavioral1
Sample
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe
Resource
win7-20240221-en
General
-
Target
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe
-
Size
28KB
-
MD5
8e1bb22b17551346730179e6616eb42e
-
SHA1
7d2482fd93f0824e4353522c68c0fd39af445fc0
-
SHA256
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe
-
SHA512
ec3a09f32393ce91486342712e200d4d0e432f0df90a1e58dd8251281c5257372a31c50db1b5a3a0fb552fa179199d88359c07b63d6b896188dfe32cb5d18ee6
-
SSDEEP
768:EpDU6F1w9pXlmjF845NonMfo3z3aNHm4j:Epb1w9pIphknMAuH5
Malware Config
Extracted
limerat
-
aes_key
Kronic
-
antivm
true
-
c2_url
https://pastebin.com/raw/jxx7yjgK
-
delay
3
-
download_payload
false
-
install
true
-
install_name
MSIbuilder.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Service Windows\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/jxx7yjgK
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2708 MSIbuilder.exe -
Loads dropped DLL 2 IoCs
pid Process 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 4 pastebin.com 5 pastebin.com 6 0.tcp.sa.ngrok.io 20 0.tcp.sa.ngrok.io 30 0.tcp.sa.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2708 MSIbuilder.exe Token: SeDebugPrivilege 2708 MSIbuilder.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2736 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 29 PID 2088 wrote to memory of 2736 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 29 PID 2088 wrote to memory of 2736 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 29 PID 2088 wrote to memory of 2736 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 29 PID 2088 wrote to memory of 2708 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 31 PID 2088 wrote to memory of 2708 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 31 PID 2088 wrote to memory of 2708 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 31 PID 2088 wrote to memory of 2708 2088 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe"C:\Users\Admin\AppData\Local\Temp\9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe'"2⤵
- Creates scheduled task(s)
PID:2736
-
-
C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe"C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD58e1bb22b17551346730179e6616eb42e
SHA17d2482fd93f0824e4353522c68c0fd39af445fc0
SHA2569bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe
SHA512ec3a09f32393ce91486342712e200d4d0e432f0df90a1e58dd8251281c5257372a31c50db1b5a3a0fb552fa179199d88359c07b63d6b896188dfe32cb5d18ee6