Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 01:46
Static task
static1
Behavioral task
behavioral1
Sample
c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe
Resource
win7-20240419-en
General
-
Target
c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe
-
Size
262KB
-
MD5
707a6fa9d0dfc998063525e6697402b1
-
SHA1
e5a930dab328f46a1f7f9b25115b08a8666616e4
-
SHA256
c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20
-
SHA512
80d682e357f08fd02abfc255000cc4ba0d7b8ca705a850f78822c61fa4c7a702984ca2f8e73500dab33964a43bba7098b16e1a3ad7bb9375f34b698377b878f1
-
SSDEEP
3072:kJ3DOOITimBCpBigzNm1VD4Uh4iYatRlgpa/hz58O0Bz65/M6If+3Js+3JFkKeTn:WDdb7Tz0T4ihtz8WzYxBt25
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/6bPeUTd1
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2712 Plugin.exe -
Loads dropped DLL 2 IoCs
pid Process 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 4 pastebin.com 5 pastebin.com 6 0.tcp.sa.ngrok.io 14 0.tcp.sa.ngrok.io 22 0.tcp.sa.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2608 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe Token: SeDebugPrivilege 2712 Plugin.exe Token: SeDebugPrivilege 2712 Plugin.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2608 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 29 PID 1612 wrote to memory of 2608 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 29 PID 1612 wrote to memory of 2608 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 29 PID 1612 wrote to memory of 2608 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 29 PID 1612 wrote to memory of 2712 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 31 PID 1612 wrote to memory of 2712 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 31 PID 1612 wrote to memory of 2712 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 31 PID 1612 wrote to memory of 2712 1612 c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe"C:\Users\Admin\AppData\Local\Temp\c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe'"2⤵
- Creates scheduled task(s)
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5707a6fa9d0dfc998063525e6697402b1
SHA1e5a930dab328f46a1f7f9b25115b08a8666616e4
SHA256c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20
SHA51280d682e357f08fd02abfc255000cc4ba0d7b8ca705a850f78822c61fa4c7a702984ca2f8e73500dab33964a43bba7098b16e1a3ad7bb9375f34b698377b878f1