Analysis
-
max time kernel
1199s -
max time network
1200s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17-06-2024 19:48
General
-
Target
MuRra1N Installer.exe
-
Size
15.7MB
-
MD5
037ac0e6baf12a5eaf477c48fe923f2e
-
SHA1
19cadd63865579f4f7ceee970c731d9ff0e5a20a
-
SHA256
13a21602d5f5fceadfb7e45828fe76a44dc2dab2932fed665938715af574be9d
-
SHA512
70f80fc9bd3c9b163d694376b294619810099146b09b0bf479e5435001758bbe9450ba72766e4cdb873e68c205d9f85df6fc4129f33f7043fc90f86bc4c4e5b0
-
SSDEEP
393216:5NqIqvpE65+X2WPccsW9DM27doT6VWD2Ln9CDuIuLGgvKcE:50i6UmGM27mmsAn9C6fGgv/
Malware Config
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MuRra1N Installer.exe"C:\Users\Admin\AppData\Local\Temp\MuRra1N Installer.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\MuRra1N.exe"C:\Users\Admin\Downloads\MuRra1N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\7f259fe638f74961afe0902f8e73485f /t 2100 /p 4361⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
Filesize
1.2MB
MD58ef41798df108ce9bd41382c9721b1c9
SHA11e6227635a12039f4d380531b032bf773f0e6de0
SHA256bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
SHA5124c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
-
Filesize
9.8MB
MD529cfe05afad44fdbc83fa3671891688f
SHA1429de9b3429abd612c7c8343614c62e17ff4130b
SHA2561479cd2a1a05c905f63483a40d9ec251f044161a81fb585e4d7d469b7bc291af
SHA512c749c45924d4059f30ba918b31856cea7b6c74e4ebd982dc2dd05c3de3a30014ac38e45eeb796c447450bb07e02c2da00c61126709995ff4ff3bf0266ad842e5
-
Filesize
9KB
MD51d1c996b6ff660cdb29884546d94d7f5
SHA1259123cf0e5bfeba4a44704858751042f1b036c4
SHA2567ed841b0dfa126544b3f115a70584a2a6b0e3772b937ae1f3217339cbdf899c7
SHA512825e1ad2696d1516714c619a1a2187ffa3b34dd4d6d231ed7d2abb1493fdbc601417935ac8ac7d7abecf6ad920210a88d5a8c1831d4194392aa0f771c6e63e58
-
Filesize
3.3MB
-
Filesize
16.5MB
-
Filesize
408KB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
19.4MB
-
Filesize
15.7MB