Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 10:35
Behavioral task
behavioral1
Sample
a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe
Resource
win7-20240221-en
General
-
Target
a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe
-
Size
126KB
-
MD5
08bae97aa3ca7a364e6bbe2aa6e8b8b6
-
SHA1
f6b7179fa8cc6a3b062c8c7b5a914c5b8f6e0312
-
SHA256
a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f
-
SHA512
ba47cc9c514627386f1f4d202b46ef182ec332db6183f4e8f5474bd13e491d91a5f7a7ee272d1d647f98ae55e553a60229100ba645c60c2e5c87b973aaf5c5a1
-
SSDEEP
3072:uewtvfrOPCNBz65/M6If+3Js+3JFkKeTn:RaqCxBt25
Malware Config
Extracted
limerat
-
aes_key
Jesus
-
antivm
false
-
c2_url
https://pastebin.com/raw/6bPeUTd1
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Plugin.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\System\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/6bPeUTd1
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Plugin.exepid process 2716 Plugin.exe -
Loads dropped DLL 2 IoCs
Processes:
a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exepid process 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 4 pastebin.com 5 pastebin.com 6 0.tcp.sa.ngrok.io 20 0.tcp.sa.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Plugin.exedescription pid process Token: SeDebugPrivilege 2716 Plugin.exe Token: SeDebugPrivilege 2716 Plugin.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exedescription pid process target process PID 1400 wrote to memory of 2568 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe schtasks.exe PID 1400 wrote to memory of 2568 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe schtasks.exe PID 1400 wrote to memory of 2568 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe schtasks.exe PID 1400 wrote to memory of 2568 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe schtasks.exe PID 1400 wrote to memory of 2716 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe Plugin.exe PID 1400 wrote to memory of 2716 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe Plugin.exe PID 1400 wrote to memory of 2716 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe Plugin.exe PID 1400 wrote to memory of 2716 1400 a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe Plugin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe"C:\Users\Admin\AppData\Local\Temp\a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe'"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\System\Plugin.exeFilesize
126KB
MD508bae97aa3ca7a364e6bbe2aa6e8b8b6
SHA1f6b7179fa8cc6a3b062c8c7b5a914c5b8f6e0312
SHA256a7b1c2a715bb2f2a6358825f341bcd9e3db00164f44afae1a1e8538ebfdf3a9f
SHA512ba47cc9c514627386f1f4d202b46ef182ec332db6183f4e8f5474bd13e491d91a5f7a7ee272d1d647f98ae55e553a60229100ba645c60c2e5c87b973aaf5c5a1
-
memory/1400-0-0x000000007439E000-0x000000007439F000-memory.dmpFilesize
4KB
-
memory/1400-1-0x0000000001070000-0x0000000001096000-memory.dmpFilesize
152KB
-
memory/1400-13-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2716-12-0x0000000000170000-0x0000000000196000-memory.dmpFilesize
152KB
-
memory/2716-14-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2716-15-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2716-16-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2716-17-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB