Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe
Resource
win7-20231129-en
General
-
Target
ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe
-
Size
245KB
-
MD5
537a30bc79e3d7beb31da053f09d6f67
-
SHA1
d9dac6725bf93e9c700ab76601be7afd76a35193
-
SHA256
ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7
-
SHA512
987aad35c946117559411589cc4ea0cfd1d7fdced71f0ab71e520f0ace33224e71a938fd1b9d5bd9c60989e05594d78cbd2953d510b68e36204955019c26b032
-
SSDEEP
6144:qs1k2QWeQ8njlf1owqQzQOydT81lxBt25:TO3WeVpvcOye/xBt
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/6bPeUTd1
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2740 Plugin.exe -
Loads dropped DLL 2 IoCs
pid Process 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 13 0.tcp.sa.ngrok.io 18 0.tcp.sa.ngrok.io 35 0.tcp.sa.ngrok.io 46 0.tcp.sa.ngrok.io 4 pastebin.com 5 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2740 Plugin.exe Token: SeDebugPrivilege 2740 Plugin.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2584 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 29 PID 2888 wrote to memory of 2584 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 29 PID 2888 wrote to memory of 2584 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 29 PID 2888 wrote to memory of 2584 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 29 PID 2888 wrote to memory of 2740 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 31 PID 2888 wrote to memory of 2740 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 31 PID 2888 wrote to memory of 2740 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 31 PID 2888 wrote to memory of 2740 2888 ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe"C:\Users\Admin\AppData\Local\Temp\ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe'"2⤵
- Creates scheduled task(s)
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"C:\Users\Admin\AppData\Local\Temp\System\Plugin.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5537a30bc79e3d7beb31da053f09d6f67
SHA1d9dac6725bf93e9c700ab76601be7afd76a35193
SHA256ceca4ad3a264bb47c499b1fd9ac2d89e70ecda197164742be6e3c57d30a3bde7
SHA512987aad35c946117559411589cc4ea0cfd1d7fdced71f0ab71e520f0ace33224e71a938fd1b9d5bd9c60989e05594d78cbd2953d510b68e36204955019c26b032