Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 11:03

General

  • Target

    70ca9f65d3c92e6c33f3675d309072d17c19813a130078fcdc13c6d058f936f8.exe

  • Size

    69KB

  • MD5

    ab7fa638e98debb8573b3079f3483404

  • SHA1

    28e1a42d0ffc546881ec2c0047e61b26cc8eac96

  • SHA256

    70ca9f65d3c92e6c33f3675d309072d17c19813a130078fcdc13c6d058f936f8

  • SHA512

    72ad4054d459d5e2b620b600451d45a41cca44a8878ae0f4646f372744c7b8ab71429bbb53f71c18d82eb947b2984bb7dfea02b7d20a0721bd3349b395eaaf08

  • SSDEEP

    1536:OrSaZBZzMbqFYMghINZo60+Ebg6afaI7iOgDL/e:OrSaZBZz73PYqp7ibn/e

Score
10/10

Malware Config

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/0MvkFDxA

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70ca9f65d3c92e6c33f3675d309072d17c19813a130078fcdc13c6d058f936f8.exe
    "C:\Users\Admin\AppData\Local\Temp\70ca9f65d3c92e6c33f3675d309072d17c19813a130078fcdc13c6d058f936f8.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-0-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/2484-1-0x00000000007A0000-0x00000000007B6000-memory.dmp

    Filesize

    88KB

  • memory/2484-2-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB

  • memory/2484-3-0x0000000002930000-0x0000000002938000-memory.dmp

    Filesize

    32KB

  • memory/2484-4-0x0000000005180000-0x000000000521C000-memory.dmp

    Filesize

    624KB

  • memory/2484-5-0x0000000005080000-0x00000000050E6000-memory.dmp

    Filesize

    408KB

  • memory/2484-6-0x0000000005D50000-0x00000000062F4000-memory.dmp

    Filesize

    5.6MB

  • memory/2484-7-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/2484-8-0x0000000005070000-0x0000000005080000-memory.dmp

    Filesize

    64KB