Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 16:46
Behavioral task
behavioral1
Sample
71E04DD1A7AD7068FA236CB7AEB647B3.exe
Resource
win7-20240215-en
General
-
Target
71E04DD1A7AD7068FA236CB7AEB647B3.exe
-
Size
30KB
-
MD5
71e04dd1a7ad7068fa236cb7aeb647b3
-
SHA1
83fdc084031f6ffb1fb3488166100628e1656c65
-
SHA256
2889c2834599b95a91d0b4136ed7df199d62e47061dd01d18922d7a7fb15954e
-
SHA512
0ade5a8a32375a8600078225f81d6f3c40dc333ec0dfbf765f3c4260258a98a7ff0f2d7f6e78122195d49b0241176639b165967fc873270606a164c56c4c5f11
-
SSDEEP
384:jB+Sbj6NKaxQ6rHAHLc3HHIqDs7xvNEHJbvDKNrCeJE3WNgEztoMelxGJJx0WDQV:tpai6rHwLqY7xvNEpr45N/zKlxGnn/j
Malware Config
Extracted
limerat
bc1q5dct32xckc9352ze647cf8lsv0vjaldp9vpvk6
-
aes_key
1111
-
antivm
true
-
c2_url
https://pastebin.com/raw/bH4cFgdP
-
delay
3
-
download_payload
false
-
install
true
-
install_name
RegScanner.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\System\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/bH4cFgdP
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2884 RegScanner.exe -
Loads dropped DLL 2 IoCs
pid Process 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2892 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe 2884 RegScanner.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2884 RegScanner.exe Token: SeDebugPrivilege 2884 RegScanner.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2892 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 29 PID 2620 wrote to memory of 2892 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 29 PID 2620 wrote to memory of 2892 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 29 PID 2620 wrote to memory of 2892 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 29 PID 2620 wrote to memory of 2884 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 31 PID 2620 wrote to memory of 2884 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 31 PID 2620 wrote to memory of 2884 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 31 PID 2620 wrote to memory of 2884 2620 71E04DD1A7AD7068FA236CB7AEB647B3.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\71E04DD1A7AD7068FA236CB7AEB647B3.exe"C:\Users\Admin\AppData\Local\Temp\71E04DD1A7AD7068FA236CB7AEB647B3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\System\RegScanner.exe'"2⤵
- Creates scheduled task(s)
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\System\RegScanner.exe"C:\Users\Admin\AppData\Local\Temp\System\RegScanner.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD571e04dd1a7ad7068fa236cb7aeb647b3
SHA183fdc084031f6ffb1fb3488166100628e1656c65
SHA2562889c2834599b95a91d0b4136ed7df199d62e47061dd01d18922d7a7fb15954e
SHA5120ade5a8a32375a8600078225f81d6f3c40dc333ec0dfbf765f3c4260258a98a7ff0f2d7f6e78122195d49b0241176639b165967fc873270606a164c56c4c5f11