Overview

overview

10

Static

static

3

1580de0781...18.exe

windows7-x64

10

1580de0781...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 09:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1580de07812e8327fa45cac871a7d0fa_JaffaCakes118.exe

  • Size

    89KB

  • MD5

    1580de07812e8327fa45cac871a7d0fa

  • SHA1

    887c01ee1254c93b2506ffdaa97b9833e454b5f9

  • SHA256

    b7a2082ded2f96c5d5ad618b0368ff4530c4bed5594217b8a8e8d0de7c346873

  • SHA512

    8ad94a2da86d9f6f478e04ec36fe7a33ad4f7df0bf14f19e987c6d2b508b1c9f06431b38ecb66db9c632d9a4727286e175585b3061b4be2ad0db36f1c3c4fed6

  • SSDEEP

    1536:LxeLXlA3C0+BGV1j9Po2rV9KL/74pYMHfkpumnxGeHfuS:LALg9lV1ZPo2rV9K7Y8pumMSfuS

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/v9J7B6vz

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1580de07812e8327fa45cac871a7d0fa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1580de07812e8327fa45cac871a7d0fa_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\killisrael.exe'"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1604
    • C:\Users\Admin\AppData\Local\Temp\killisrael.exe
      "C:\Users\Admin\AppData\Local\Temp\killisrael.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3044,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
    1⤵
      PID:4344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\killisrael.exe
      Filesize

      89KB

      MD5

      1580de07812e8327fa45cac871a7d0fa

      SHA1

      887c01ee1254c93b2506ffdaa97b9833e454b5f9

      SHA256

      b7a2082ded2f96c5d5ad618b0368ff4530c4bed5594217b8a8e8d0de7c346873

      SHA512

      8ad94a2da86d9f6f478e04ec36fe7a33ad4f7df0bf14f19e987c6d2b508b1c9f06431b38ecb66db9c632d9a4727286e175585b3061b4be2ad0db36f1c3c4fed6

      Download Submit

    • memory/2592-20-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2592-18-0x0000000001FD0000-0x0000000001FF6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2592-19-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2592-22-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2592-23-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4660-2-0x0000000001330000-0x0000000001356000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4660-3-0x00000000015F0000-0x0000000001600000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-4-0x0000000001600000-0x0000000001618000-memory.dmp

      Filesize

      96KB

      Download

    • memory/4660-5-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4660-0-0x00007FFFAC593000-0x00007FFFAC595000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4660-1-0x0000000000B70000-0x0000000000B8C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/4660-21-0x00007FFFAC590000-0x00007FFFAD051000-memory.dmp

      Filesize

      10.8MB

      Download