Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23-08-2024 10:27
General
-
Target
bb5b6495d22a722624313fb4076749cb_JaffaCakes118.exe
-
Size
17.3MB
-
MD5
bb5b6495d22a722624313fb4076749cb
-
SHA1
c7db683ca054476a7ba37932b22ba9d131140213
-
SHA256
2e13890ad41d07c20e2f6cec6d162fa7ecba08a1f57e4a34ab4988f4964e5aa2
-
SHA512
9f5e5c6d1d27143c3d9166fc0620c97a5af06639903e7ea584ba8b24c4756dc7f1fbaee8de6bb9ad3bb45c0a3899fcc3cc7e181dbf151f5075ef9c935fb0c1bc
-
SSDEEP
393216:rcJYwsM/YX3UZiVEiq+mEwZjGVanL54XVSeygXiWjT3iBGsIcRxiJOzMNe5vjAKG:uYjM/9+EC0tCky4eywf3iosJ6JOAN8v4
Malware Config
Extracted
limerat
1CyeYH7fGe5QHyuQf9a7LRfsU3hdEQUHqC
-
aes_key
holamundo
-
antivm
false
-
c2_url
https://pastebin.com/raw/4xq9XHX8
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/4xq9XHX8
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb5b6495d22a722624313fb4076749cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bb5b6495d22a722624313fb4076749cb_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\FIPcjETDIhlae2Vs.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
MD516573795f77e76bd709b505336d4e6f6
SHA1958f2c96a2023c97e132e25a1ebc59480f326444
SHA2563e30268c17daf5648d1b34fe8a3dbb49bda6cc02e1f2e182452950fbee9d3c3d
SHA512a165f9bdc1cb88d34fc73f7cfba658c6d95d07c175a9b517725f178b217c29dcb8359666bf3fec1ccd04bee70a5ec75d35d458f7517bafb96c5327f761aab783
-
Filesize
4KB
-
Filesize
17.3MB
-
Filesize
6.9MB
-
Filesize
11.1MB
-
Filesize
6.9MB
-
Filesize
11.0MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
412KB
-
Filesize
92KB
-
Filesize
1.5MB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
16.7MB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
2.3MB
-
Filesize
76KB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
284KB
-
Filesize
312KB
-
Filesize
208KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
464KB
-
Filesize
76KB
-
Filesize
168KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
1.0MB
-
Filesize
2.7MB
-
Filesize
140KB
-
Filesize
84KB
-
Filesize
392KB
-
Filesize
264KB
-
Filesize
788KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
348KB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
72KB
-
Filesize
2.0MB
-
Filesize
24.4MB