Overview
overview
10Static
static
10Lime-Multi...in.zip
windows10-2004-x64
10Lime-Multi...DME.md
windows10-2004-x64
3Lime-Multi...ts.txt
windows10-2004-x64
1Lime-Multi...ain.py
windows10-2004-x64
3Lime-Multi...11.exe
windows10-2004-x64
8�4o.��_.pyc
windows10-2004-x64
Lime-Multi...rt.bat
windows10-2004-x64
10Analysis
-
max time kernel
430s -
max time network
433s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 16:59
Behavioral task
behavioral1
Sample
Lime-MultiTool-main.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Lime-MultiTool-main/README.md
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Lime-MultiTool-main/requirements.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Lime-MultiTool-main/src/main.py
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
�4o.��_.pyc
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Lime-MultiTool-main/start.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Lime-MultiTool-main/src/main.py
-
Size
10KB
-
MD5
20bf3cb36efe0d6892662a45305c513b
-
SHA1
5b07501a82e6fbdbc267f75ad86f5ad9de6b77ab
-
SHA256
4290ec5465d14f98801de3400e0cb078586b6e27bc4bf6c7a1f87de036e8a6c9
-
SHA512
d3d719cb129ff20a1a70bc072e30a2fa18f9813631983d3e08882c88859588e13d631ebf22d0e471de3142ac292b7efabc085310d8eecbaa99b8be1245cad83c
-
SSDEEP
192:MTqreYeTbvBTHF1Z0SQuHaNOVV583zcapKENphISRfm2fT2yUAtCrBC1b8bd4CyD:MToeTbvBTlXCa7bujRs8pWS+QinACIBP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\翄뇃✀谀耎\ = "py_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.py OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.py\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\翄뇃✀谀耎 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\py_auto_file\shell\edit\command OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1580 OpenWith.exe -
Suspicious use of SetWindowsHookEx 45 IoCs
pid Process 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1580 wrote to memory of 640 1580 OpenWith.exe 106 PID 1580 wrote to memory of 640 1580 OpenWith.exe 106
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\main.py1⤵
- Modifies registry class
PID:2992
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\main.py2⤵PID:640
-