Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 17:45

General

  • Target

    HWID Changer by SILENQER/compreg/config.exe

  • Size

    1.1MB

  • MD5

    fa841009c24985df81baae7d44f3e3ee

  • SHA1

    aebdcf268615a1de7f330bed68edd3a3a86e244e

  • SHA256

    793601e28e74f3850b8ea2ae83f87d34ad6d469e2ff334b8987f414aab8577b4

  • SHA512

    1d58d842d4572029aa2887a289edf19e8e33e2b5e3d387fcab4470535cd4cfb45b44d1f8bae8798ffd1a45e089510b52b9925402cb5648e5a10889705cfd41f9

  • SSDEEP

    24576:eR+cl7X1BRnI6hmebbe1dEt8QR04TG8Ev4P0D6epjKXwzG3X8MHf3VDTXK:a+clb1BRntmeXKd9Q3G85sDzpOXoE8x

Score
10/10

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    Remcos

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/fBSseKkF

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/fBSseKkF

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Limerat family
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe
    "C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Program Files\MSextract\MSbuild.exe
      "C:\Program Files\MSextract\MSbuild.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcjPCP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4DA3.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3020
      • C:\Program Files\MSextract\MSbuild.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2924
    • C:\Program Files\MSextract\HWID Changer.exe
      "C:\Program Files\MSextract\HWID Changer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\MSextract\HWID Changer.exe

    Filesize

    885KB

    MD5

    43c147d6afafbf546ac6fdfe4ae049c9

    SHA1

    faf2ced44d5794372c0c42b32d47f68580e18dbf

    SHA256

    9ecccf1c26e43ca90cf997dc0ecd3e1ef6f3405a8bc46583725bc7e1d27fd235

    SHA512

    249b1c7130c3dd9c315c2eeafdb2748d0c97b9cd710056b36d983785e01185e308ef2a1c80d0c1d7adce05557b6b70ac7dcf581be7975836651ef98673fa7bb8

  • C:\Program Files\MSextract\MSbuild.exe

    Filesize

    858KB

    MD5

    a71cd5886cca33a25f832a1ed37bc4af

    SHA1

    7bacf2f5f80c03a298528106a34db71951a1e94e

    SHA256

    8c5b2aa9fc23e7e50d09bb41c9729efd821e6094a0477a65054ff20938723d88

    SHA512

    eb672552875d873dd2e5518ac022e99e0a8531a52f9d67f2dbaf09b66809483a7881fbf46472ed9f38df9bb46bd89016a53220fbf38149a2c507efda0a66be03

  • C:\Users\Admin\AppData\Local\Temp\tmp4DA3.tmp

    Filesize

    1KB

    MD5

    b6e455cbc2ff4b1be4fac0c6ba6ad14b

    SHA1

    5703f647bf4f9768241436e60416436b6cb476f6

    SHA256

    4c214b3e9a5c135e21dbf1ff6bcf4ac7786c19bbf4ea199373ff0c254e169564

    SHA512

    4757c1dbb8e88457c94301fc1bf92e37b28c0ec71d2418bcba3e52ab78153f7c0e92f8ce2aa99043fca8e6635083e8a193d2e0080832d0581cf7eeb5d5503b39

  • memory/1496-34-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1496-32-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1496-27-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1496-29-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1496-25-0x00000000001A0000-0x0000000000284000-memory.dmp

    Filesize

    912KB

  • memory/2420-36-0x0000000004390000-0x00000000043C0000-memory.dmp

    Filesize

    192KB

  • memory/2420-24-0x0000000074CCE000-0x0000000074CCF000-memory.dmp

    Filesize

    4KB

  • memory/2420-30-0x0000000000510000-0x0000000000524000-memory.dmp

    Filesize

    80KB

  • memory/2420-33-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2420-26-0x0000000000990000-0x0000000000A6C000-memory.dmp

    Filesize

    880KB

  • memory/2420-35-0x00000000050E0000-0x0000000005164000-memory.dmp

    Filesize

    528KB

  • memory/2420-28-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2420-31-0x0000000074CCE000-0x0000000074CCF000-memory.dmp

    Filesize

    4KB

  • memory/2420-51-0x0000000074CC0000-0x00000000753AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2924-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2924-44-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2924-47-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2924-43-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2924-50-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2924-49-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2924-40-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB