Resubmissions
06-01-2025 02:41
250106-c6ynvstla1 10Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-01-2025 02:41
Behavioral task
behavioral1
Sample
Lime-MultiTool-main/src/main.py
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Lime-MultiTool-main/src/main.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Lime-MultiTool-main/start.bat
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Lime-MultiTool-main/start.bat
Resource
win10v2004-20241007-en
General
-
Target
Lime-MultiTool-main/src/main.py
-
Size
10KB
-
MD5
20bf3cb36efe0d6892662a45305c513b
-
SHA1
5b07501a82e6fbdbc267f75ad86f5ad9de6b77ab
-
SHA256
4290ec5465d14f98801de3400e0cb078586b6e27bc4bf6c7a1f87de036e8a6c9
-
SHA512
d3d719cb129ff20a1a70bc072e30a2fa18f9813631983d3e08882c88859588e13d631ebf22d0e471de3142ac292b7efabc085310d8eecbaa99b8be1245cad83c
-
SSDEEP
192:MTqreYeTbvBTHF1Z0SQuHaNOVV583zcapKENphISRfm2fT2yUAtCrBC1b8bd4CyD:MToeTbvBTlXCa7bujRs8pWS+QinACIBP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2076 rundll32.exe 764 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 764 AcroRd32.exe 764 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 300 wrote to memory of 2076 300 cmd.exe 31 PID 300 wrote to memory of 2076 300 cmd.exe 31 PID 300 wrote to memory of 2076 300 cmd.exe 31 PID 2076 wrote to memory of 764 2076 rundll32.exe 33 PID 2076 wrote to memory of 764 2076 rundll32.exe 33 PID 2076 wrote to memory of 764 2076 rundll32.exe 33 PID 2076 wrote to memory of 764 2076 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\main.py1⤵
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\main.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\main.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:764
-
-