Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 16:37
General
-
Target
2ae2ff3322d02131f692ace1f71aac6d_JaffaCakes118.exe
-
Size
452KB
-
MD5
2ae2ff3322d02131f692ace1f71aac6d
-
SHA1
3c404c9bc2a1fdb546e74dca66e35f4742687679
-
SHA256
4dda0e4e2597929c136fdbe763d1dd3899253f4188697ea555c71c5996029620
-
SHA512
683e750d9fc6a9f32a45d680e1db634b3eb071b70b441fc5a1fe7fbc2d1f496d1d4676136d58e3e5458614f10eb4d80f80726eab589186b6b788b51d8190da53
-
SSDEEP
6144:4hEFvdiblx6L10wOq1MXuDGCdWJPAzu9Tjz4/ri3F5fGTeQD4K9yYC5IzrvsKeT:43Pq1uuD/uE+DfGCQDSZ5m+
Malware Config
Extracted
limerat
-
aes_key
jack
-
antivm
false
-
c2_url
https://pastebin.com/raw/YtyeDvFZ
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/YtyeDvFZ
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 49 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ae2ff3322d02131f692ace1f71aac6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ae2ff3322d02131f692ace1f71aac6d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\System32\cscript.exe" //B //Nologo C:\Users\Admin\vbc.vbs2⤵
- Drops startup file
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
MD52ae2ff3322d02131f692ace1f71aac6d
SHA13c404c9bc2a1fdb546e74dca66e35f4742687679
SHA2564dda0e4e2597929c136fdbe763d1dd3899253f4188697ea555c71c5996029620
SHA512683e750d9fc6a9f32a45d680e1db634b3eb071b70b441fc5a1fe7fbc2d1f496d1d4676136d58e3e5458614f10eb4d80f80726eab589186b6b788b51d8190da53
-
Filesize
263B
MD5e2fa162484a572ea7bb469e513bb2516
SHA157bdeadcaff9894cabfd5d4258bdeb929aa8e242
SHA256128ba94c436c2308147c945e2321f1625cce2ac3726bdd67a64a75f3932276b7
SHA5125ebaabdfe844de35b8889becb459930baebb996ae1f20992f12f5efea69d426abe5bc43b18fac6d51b1a6b6f4374e593485b09cdd97da8dbe2b244eb02294253
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
48KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
48KB