Analysis
-
max time kernel
5s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 18:11
General
-
Target
xdwd.exe
-
Size
25KB
-
MD5
aae04417cc07c39988d4fbe0e85fc9bd
-
SHA1
2d51b49f8f1faeba674dd0993911e8f65b4d2258
-
SHA256
f81bc717944ec8a599c8276d9d3b1de4b995d5570139590d263b39e47e87ba3d
-
SHA512
53cc6468da9be1f4a3cc3089b1ed6a7544eb5cc5f91ae8dc1390688ffe10ad9aff1df224a5cd936276440ee95cb4afcaec7cf4f63332297864179c3266560dfb
-
SSDEEP
384:EB+Sbj6NKIPw6LZhAHt2vTh34EnWb5j4kDhlzCTJEUmNYEYQro3lcOjsjr:CpI46Lnwt4aE+RHtN8oj
Malware Config
Extracted
limerat
-
aes_key
1337
-
antivm
false
-
c2_url
https://pastebin.com/raw/rACMKa5f
-
delay
3
-
download_payload
false
-
install
true
-
install_name
xdwd.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\xdwd\
-
usb_spread
true
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Limerat family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xdwd.exe"C:\Users\Admin\AppData\Local\Temp\xdwd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\xdwd\xdwd.exe'"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\xdwd\xdwd.exe"C:\Users\Admin\AppData\Roaming\xdwd\xdwd.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Regasm.exe" -B --donate-level=0 -t 8 -a cryptonight --url= -u -p -R --variant=-1 --max-cpu-usage=903⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709B
MD58a1197be130e48aa5aeeafd43eb6bb9f
SHA1cb790c7c216e41524348eaa0e5b74926e78dbfc6
SHA256547474087ec8f71dfd32b76f9b74c86f9844addf5082df37562a2c2c0cae4bfb
SHA5124ad9d8dbbc253c8d7b1c2b4ec5f115c770f02bdbbc21ca0b422e251a3a98331e169c5062cabf7da81d5ae0d295b3778ef105ef82709df1a4ace71be288b8f166
-
Filesize
25KB
MD5aae04417cc07c39988d4fbe0e85fc9bd
SHA12d51b49f8f1faeba674dd0993911e8f65b4d2258
SHA256f81bc717944ec8a599c8276d9d3b1de4b995d5570139590d263b39e47e87ba3d
SHA51253cc6468da9be1f4a3cc3089b1ed6a7544eb5cc5f91ae8dc1390688ffe10ad9aff1df224a5cd936276440ee95cb4afcaec7cf4f63332297864179c3266560dfb
-
Filesize
624KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
48KB
-
Filesize
504KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB