Analysis

  • max time kernel
    60s
  • max time network
    64s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 07:50

General

  • Target

    SPYdroiedVIP.exe

  • Size

    139.8MB

  • MD5

    b7d3b8f8e284fb9b586cf8969e83100c

  • SHA1

    7b6caeb90302ec3bc0f426fd925ecdf5d19b0b92

  • SHA256

    f08f44a1a04d641fda13aff23cdcaf85cc86237ee9924b6b78835906bae17f3b

  • SHA512

    8e89598300214f5d4a6c8e6e373a03d236d024e81d95b9a9e10c131c2e120c1183d4c569aaeff9e1f33c231847b00afb570a10329afd23b2f09da49cb16358e6

  • SSDEEP

    3145728:jqU9w0EOiCbAP/Sc6lTB6rtt2ScCcfxc5VJwAtHk4u81+91i9slbf1TME4:2Cw0EOiA+3z0HfO5VJwAtHg8+Vf1x4

Malware Config

Extracted

Family

limerat

Wallets

bc1qe6qclrn8s8ss6kcuh5n03mtn2m86zml3ucwtsa

Attributes
  • aes_key

    len-13395

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/u8f09e5b

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    VCruintime.exe

  • main_folder

    AppData

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Extracted

Family

xworm

C2

redslide133-49604.portmap.host:49604

wiz.bounceme.net:6000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7245769901:AAG_37K7d0DlKNRIZshszMjtQDXRfUiSCa4/sendMessage?chat_id=6652235050

aes.plain

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/u8f09e5b

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 3 IoCs
  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • AgentTesla payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SPYdroiedVIP.exe
    "C:\Users\Admin\AppData\Local\Temp\SPYdroiedVIP.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\idVIP.exe
      "C:\Users\Admin\AppData\Local\Temp\idVIP.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3276
    • C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\Users\Admin\AppData\Local\Temp\wlanext.exe
        "C:\Users\Admin\AppData\Local\Temp\wlanext.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1920
      • C:\Users\Admin\AppData\Local\Temp\VCruntime.exe
        "C:\Users\Admin\AppData\Local\Temp\VCruntime.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VCruntime.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2852
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VCruntime.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VCruntime.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:980
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "VCruntime" /tr "C:\ProgramData\VCruntime.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4608
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1524
        3⤵
        • Program crash
        PID:4580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 4068
    1⤵
      PID:1032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      52afa702b34ab802e2ecd71d9539c829

      SHA1

      6a6f18158c82910e158d7e27972486c6e4dc5c93

      SHA256

      992fefff5236c174b6dd74b76a2c5c0d33470bec786ee4b30f5577aea27b8025

      SHA512

      5e42fead63b34fb62e4173e83e11110543583aece41f736c007d8512e8f23b6713140c9233bf99f9b9d1c3302a2f526bd4d33ed1ce1f777c9e0d9dea25e37639

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      98baf5117c4fcec1692067d200c58ab3

      SHA1

      5b33a57b72141e7508b615e17fb621612cb8e390

      SHA256

      30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51

      SHA512

      344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d

    • C:\Users\Admin\AppData\Local\Temp\VCruntime.exe

      Filesize

      89KB

      MD5

      225850cf18d6e1256f70862fdbd6afb3

      SHA1

      f5b2d3b010eca4d84904a28f8fbc39c2f38a12b4

      SHA256

      69ca909fbad74b756b6094a69da49df464ff5d34b5362e7c19e0ae731c40fb0f

      SHA512

      54d2edd402a959b3790233f521baa06948abff801312fa3cc9b26486679dbf4af3ab8c7a64ebbd89c38f48925647cd3614e96764b60fe27853b185edf78fae6e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npydobat.iho.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\wlanext.exe

      Filesize

      32KB

      MD5

      1a89346c2f5d142140070249972a2211

      SHA1

      dec0ec575a56e847843b4253c25861abfc23a898

      SHA256

      b54e2ca4b6324ac1579641c423ee06285590e780184d7a3df6ee0899d8499d9e

      SHA512

      cb78cc5ba228a73e3475812b6361817cf149c22eb644ffb70c56c92d726082400df951c4fbc2aa41d29280bf651e2636ff5390dc6fda3be36382f6436b19ad3c

    • memory/2852-185-0x000001D780030000-0x000001D780052000-memory.dmp

      Filesize

      136KB

    • memory/3208-236-0x000000001EED0000-0x000000001EEDE000-memory.dmp

      Filesize

      56KB

    • memory/3208-163-0x0000000000DC0000-0x0000000000DDC000-memory.dmp

      Filesize

      112KB

    • memory/3276-84-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-86-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-49-0x000000001CFE0000-0x0000000021FF8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-50-0x000000001CFE0000-0x0000000021FF8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-54-0x000000001CFE0000-0x0000000021FF8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-61-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-75-0x000000001DA00000-0x000000001DA0A000-memory.dmp

      Filesize

      40KB

    • memory/3276-62-0x000000001D9F0000-0x000000001D9FA000-memory.dmp

      Filesize

      40KB

    • memory/3276-67-0x000000001D9F0000-0x000000001D9FA000-memory.dmp

      Filesize

      40KB

    • memory/3276-65-0x000000001D9F0000-0x000000001D9FA000-memory.dmp

      Filesize

      40KB

    • memory/3276-76-0x00007FFE1DC30000-0x00007FFE1DD7E000-memory.dmp

      Filesize

      1.3MB

    • memory/3276-63-0x000000001D9F0000-0x000000001D9FA000-memory.dmp

      Filesize

      40KB

    • memory/3276-80-0x000000001DA00000-0x000000001DA0A000-memory.dmp

      Filesize

      40KB

    • memory/3276-79-0x000000001DA00000-0x000000001DA0A000-memory.dmp

      Filesize

      40KB

    • memory/3276-78-0x000000001DA00000-0x000000001DA0A000-memory.dmp

      Filesize

      40KB

    • memory/3276-82-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-83-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-33-0x0000000180000000-0x0000000180005000-memory.dmp

      Filesize

      20KB

    • memory/3276-85-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-87-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-88-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-23-0x000000001AB70000-0x000000001AD10000-memory.dmp

      Filesize

      1.6MB

    • memory/3276-89-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-90-0x000000002BFA0000-0x0000000030FB8000-memory.dmp

      Filesize

      80.1MB

    • memory/3276-167-0x000000001F5A0000-0x000000001F5C2000-memory.dmp

      Filesize

      136KB

    • memory/3276-34-0x0000000180000000-0x0000000180005000-memory.dmp

      Filesize

      20KB

    • memory/3276-179-0x000000001F8C0000-0x000000001F8DC000-memory.dmp

      Filesize

      112KB

    • memory/3276-181-0x000000001F980000-0x000000001F9BC000-memory.dmp

      Filesize

      240KB

    • memory/3276-180-0x000000001F910000-0x000000001F93C000-memory.dmp

      Filesize

      176KB

    • memory/3276-178-0x000000001F6B0000-0x000000001F6BC000-memory.dmp

      Filesize

      48KB

    • memory/3276-182-0x0000000021010000-0x0000000021222000-memory.dmp

      Filesize

      2.1MB

    • memory/3276-183-0x0000000021230000-0x000000002157A000-memory.dmp

      Filesize

      3.3MB

    • memory/3276-184-0x00000000207A0000-0x000000002097C000-memory.dmp

      Filesize

      1.9MB

    • memory/3276-36-0x0000000180000000-0x0000000180005000-memory.dmp

      Filesize

      20KB

    • memory/3276-38-0x0000000180000000-0x0000000180005000-memory.dmp

      Filesize

      20KB

    • memory/3276-198-0x0000000021580000-0x000000002179E000-memory.dmp

      Filesize

      2.1MB

    • memory/3276-40-0x0000000180000000-0x0000000180005000-memory.dmp

      Filesize

      20KB

    • memory/3276-24-0x000000001AB70000-0x000000001AD10000-memory.dmp

      Filesize

      1.6MB

    • memory/3276-209-0x0000000021AC0000-0x0000000021BC0000-memory.dmp

      Filesize

      1024KB

    • memory/3276-22-0x000000001AB70000-0x000000001AD10000-memory.dmp

      Filesize

      1.6MB

    • memory/3276-16-0x00007FFE214B0000-0x00007FFE21F71000-memory.dmp

      Filesize

      10.8MB

    • memory/4068-47-0x0000000000AD0000-0x0000000001AD0000-memory.dmp

      Filesize

      16.0MB

    • memory/4068-48-0x000000000BE80000-0x000000000BF1C000-memory.dmp

      Filesize

      624KB

    • memory/4068-107-0x000000000BF20000-0x000000000F3E8000-memory.dmp

      Filesize

      52.8MB