Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 17:39
Behavioral task
behavioral1
Sample
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe
Resource
win7-20240221-en
General
-
Target
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe
-
Size
28KB
-
MD5
8e1bb22b17551346730179e6616eb42e
-
SHA1
7d2482fd93f0824e4353522c68c0fd39af445fc0
-
SHA256
9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe
-
SHA512
ec3a09f32393ce91486342712e200d4d0e432f0df90a1e58dd8251281c5257372a31c50db1b5a3a0fb552fa179199d88359c07b63d6b896188dfe32cb5d18ee6
-
SSDEEP
768:EpDU6F1w9pXlmjF845NonMfo3z3aNHm4j:Epb1w9pIphknMAuH5
Malware Config
Extracted
limerat
-
aes_key
Kronic
-
antivm
true
-
c2_url
https://pastebin.com/raw/jxx7yjgK
-
delay
3
-
download_payload
false
-
install
true
-
install_name
MSIbuilder.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Service Windows\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/jxx7yjgK
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe -
Executes dropped EXE 1 IoCs
pid Process 4936 MSIbuilder.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 67 0.tcp.sa.ngrok.io 95 0.tcp.sa.ngrok.io 25 pastebin.com 26 pastebin.com 27 0.tcp.sa.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3720 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4936 MSIbuilder.exe Token: SeDebugPrivilege 4936 MSIbuilder.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3720 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 92 PID 1612 wrote to memory of 3720 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 92 PID 1612 wrote to memory of 3720 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 92 PID 1612 wrote to memory of 4936 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 94 PID 1612 wrote to memory of 4936 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 94 PID 1612 wrote to memory of 4936 1612 9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe"C:\Users\Admin\AppData\Local\Temp\9bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe'"2⤵
- Creates scheduled task(s)
PID:3720
-
-
C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe"C:\Users\Admin\AppData\Roaming\Service Windows\MSIbuilder.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD58e1bb22b17551346730179e6616eb42e
SHA17d2482fd93f0824e4353522c68c0fd39af445fc0
SHA2569bb9a1974de3b7ca8de3fd9afd7fb0f92d8f24c33b651584b2d7e2d0bd0da2fe
SHA512ec3a09f32393ce91486342712e200d4d0e432f0df90a1e58dd8251281c5257372a31c50db1b5a3a0fb552fa179199d88359c07b63d6b896188dfe32cb5d18ee6