Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 23:52
General
-
Target
New-Client.exe
-
Size
28KB
-
MD5
7c86eee669ea7407b4dff1a26176df4f
-
SHA1
11bdf6410159fc32a232641e5b8470f8ec6ccb1b
-
SHA256
ce492124cd1c9737f21aaabc10a0f01aa073585d380446c766a7e99e11bba72e
-
SHA512
077081dc3ba1ebe84f3994730942fe126d994231260c2f1bcdc8990c61423a0e818c8457567d7c698357c77cb1e49f6f7d910b18ca6ab2e8ffefc806ce4bed20
-
SSDEEP
768:ZpWM61lwdssZKB/45NPFH6koNjDb6ygj:ZpqlwdtcBQBH6koBDb6d
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
0790308
-
antivm
false
-
c2_url
https://pastebin.com/raw/ug38C3Hv
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
Family
limerat
Attributes
-
antivm
false
-
c2_url
https://pastebin.com/raw/ug38C3Hv
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 13 pastebin.com 14 pastebin.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3236 New-Client.exe Token: SeDebugPrivilege 3236 New-Client.exe