Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 19:58

General

  • Target

    267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe

  • Size

    625KB

  • MD5

    267a4c85d232e2ac38129146e11076fe

  • SHA1

    1e8022b879ee79f2fe86ecac410a116b05ac0112

  • SHA256

    861b6c9421ebe142f5a3c13817190ab30b5b7b5e68692e886639589b784086e4

  • SHA512

    793acc93adfe3c116674bf0ab4122ebe41335dd525034ca78f5f59408976fe62a27ce98a9cbebffa476186324447083f59ecdfa210fac4f872476adedb911567

  • SSDEEP

    12288:iSJcHRFHvJTjucJ71RXKvGgKsfUReclQ42dFA3ADj6Dl18WlL0u:2RFHv5jDJDNmKlQ1dFAr0x

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

359Z6KxMenwvgkA7vpGeBtinJPTj5raZz8

Attributes
  • aes_key

    arglobal

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/CV5RHE9G

  • delay

    3

  • download_payload

    true

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    AppData

  • payload_url

    http://23.249.161.100/zaher/zna.exe

  • pin_spread

    false

  • sub_folder

    \vbc\

  • usb_spread

    false

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/CV5RHE9G

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Drops startup file 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2348-62-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-64-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-65-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2348-68-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-70-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-72-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2872-60-0x0000000004090000-0x000000000409C000-memory.dmp

    Filesize

    48KB

  • memory/2872-35-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-19-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-45-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-57-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-53-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-59-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-55-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-51-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-49-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-47-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-43-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-41-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

    Filesize

    4KB

  • memory/2872-39-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-61-0x00000000745B0000-0x0000000074C9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-37-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-8-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-33-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-31-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-29-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-27-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-25-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-23-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-21-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-17-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-15-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-13-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-9-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-11-0x0000000001EC0000-0x0000000001EDF000-memory.dmp

    Filesize

    124KB

  • memory/2872-5-0x0000000001EC0000-0x0000000001EE6000-memory.dmp

    Filesize

    152KB

  • memory/2872-4-0x0000000001F20000-0x0000000001F52000-memory.dmp

    Filesize

    200KB

  • memory/2872-3-0x00000000745B0000-0x0000000074C9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-2-0x00000000005E0000-0x0000000000664000-memory.dmp

    Filesize

    528KB

  • memory/2872-1-0x00000000001F0000-0x0000000000294000-memory.dmp

    Filesize

    656KB

  • memory/2872-73-0x00000000745B0000-0x0000000074C9E000-memory.dmp

    Filesize

    6.9MB