Overview
overview
10Static
static
3HWID Chang...er.exe
windows7-x64
10HWID Chang...er.exe
windows7-x64
10HWID Chang...ip.dll
windows10-2004-x64
1HWID Chang...ip.dll
windows7-x64
1HWID Chang...er.exe
windows10-ltsc 2021-x64
8HWID Chang...er.exe
windows7-x64
8HWID Chang...ig.exe
windows7-x64
10HWID Chang...ig.exe
windows7-x64
10Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
HWID Changer by SILENQER/HWID Changer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HWID Changer by SILENQER/HWID Changer.exe
Resource
win7-20241010-en
Behavioral task
behavioral3
Sample
HWID Changer by SILENQER/compreg/Ionic.Zip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
HWID Changer by SILENQER/compreg/Ionic.Zip.dll
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
HWID Changer by SILENQER/compreg/Launcher.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
HWID Changer by SILENQER/compreg/Launcher.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
HWID Changer by SILENQER/compreg/config.exe
Resource
win7-20240903-en
General
-
Target
HWID Changer by SILENQER/compreg/config.exe
-
Size
1.1MB
-
MD5
fa841009c24985df81baae7d44f3e3ee
-
SHA1
aebdcf268615a1de7f330bed68edd3a3a86e244e
-
SHA256
793601e28e74f3850b8ea2ae83f87d34ad6d469e2ff334b8987f414aab8577b4
-
SHA512
1d58d842d4572029aa2887a289edf19e8e33e2b5e3d387fcab4470535cd4cfb45b44d1f8bae8798ffd1a45e089510b52b9925402cb5648e5a10889705cfd41f9
-
SSDEEP
24576:eR+cl7X1BRnI6hmebbe1dEt8QR04TG8Ev4P0D6epjKXwzG3X8MHf3VDTXK:a+clb1BRntmeXKd9Q3G85sDzpOXoE8x
Malware Config
Extracted
limerat
-
aes_key
Remcos
-
antivm
false
-
c2_url
https://pastebin.com/raw/fBSseKkF
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/fBSseKkF
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Limerat family
-
Executes dropped EXE 3 IoCs
pid Process 2420 MSbuild.exe 1496 HWID Changer.exe 2924 MSbuild.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 2924 2420 MSbuild.exe 34 -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\MSextract\HWID Changer.exe config.exe File opened for modification C:\Program Files\MSextract\HWID Changer.exe config.exe File created C:\Program Files\MSextract\MSbuild.exe config.exe File opened for modification C:\Program Files\MSextract\MSbuild.exe config.exe File opened for modification C:\Program Files\MSextract config.exe File created C:\Program Files\MSextract\__tmp_rar_sfx_access_check_259443109 config.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSbuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSbuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWID Changer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2420 MSbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2420 MSbuild.exe Token: SeDebugPrivilege 2924 MSbuild.exe Token: SeDebugPrivilege 2924 MSbuild.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2420 2320 config.exe 28 PID 2320 wrote to memory of 2420 2320 config.exe 28 PID 2320 wrote to memory of 2420 2320 config.exe 28 PID 2320 wrote to memory of 2420 2320 config.exe 28 PID 2320 wrote to memory of 1496 2320 config.exe 29 PID 2320 wrote to memory of 1496 2320 config.exe 29 PID 2320 wrote to memory of 1496 2320 config.exe 29 PID 2320 wrote to memory of 1496 2320 config.exe 29 PID 2420 wrote to memory of 3020 2420 MSbuild.exe 32 PID 2420 wrote to memory of 3020 2420 MSbuild.exe 32 PID 2420 wrote to memory of 3020 2420 MSbuild.exe 32 PID 2420 wrote to memory of 3020 2420 MSbuild.exe 32 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34 PID 2420 wrote to memory of 2924 2420 MSbuild.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe"C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files\MSextract\MSbuild.exe"C:\Program Files\MSextract\MSbuild.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcjPCP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4DA3.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3020
-
-
C:\Program Files\MSextract\MSbuild.exe"{path}"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
-
C:\Program Files\MSextract\HWID Changer.exe"C:\Program Files\MSextract\HWID Changer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
885KB
MD543c147d6afafbf546ac6fdfe4ae049c9
SHA1faf2ced44d5794372c0c42b32d47f68580e18dbf
SHA2569ecccf1c26e43ca90cf997dc0ecd3e1ef6f3405a8bc46583725bc7e1d27fd235
SHA512249b1c7130c3dd9c315c2eeafdb2748d0c97b9cd710056b36d983785e01185e308ef2a1c80d0c1d7adce05557b6b70ac7dcf581be7975836651ef98673fa7bb8
-
Filesize
858KB
MD5a71cd5886cca33a25f832a1ed37bc4af
SHA17bacf2f5f80c03a298528106a34db71951a1e94e
SHA2568c5b2aa9fc23e7e50d09bb41c9729efd821e6094a0477a65054ff20938723d88
SHA512eb672552875d873dd2e5518ac022e99e0a8531a52f9d67f2dbaf09b66809483a7881fbf46472ed9f38df9bb46bd89016a53220fbf38149a2c507efda0a66be03
-
Filesize
1KB
MD5b6e455cbc2ff4b1be4fac0c6ba6ad14b
SHA15703f647bf4f9768241436e60416436b6cb476f6
SHA2564c214b3e9a5c135e21dbf1ff6bcf4ac7786c19bbf4ea199373ff0c254e169564
SHA5124757c1dbb8e88457c94301fc1bf92e37b28c0ec71d2418bcba3e52ab78153f7c0e92f8ce2aa99043fca8e6635083e8a193d2e0080832d0581cf7eeb5d5503b39