Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 10:40
Behavioral task
behavioral1
Sample
CandyDDoser-installer-15.4.1.exe
Resource
win7-20240903-en
General
-
Target
CandyDDoser-installer-15.4.1.exe
-
Size
28KB
-
MD5
f73dfb6f1169032be3b281bfecd8e27a
-
SHA1
6b487113f260ed17b0a3b4c3ecab199e57c7d0bf
-
SHA256
2278dd8c09c9f6967d1414a6254ea386fec564baea3956faeadca3a51eb0fddf
-
SHA512
b2298c03be51d8681aad8a52bb703b5da70dc522f8765aadd2ae91680672079983b3345923687b2617aa240bd31f14bc9ad029ef87fbd91563b10f4d41b0a98f
-
SSDEEP
384:qB+Sbj6NKAxZ86PTAHdWjWqDs5gGk80vDKNrCeJE3WNgbjW2ScklNeEe1bsxNEQi:ApaO6PTwdH5gGv645NwabeEe1baQdj
Malware Config
Extracted
limerat
-
aes_key
placek
-
antivm
true
-
c2_url
https://pastebin.com/raw/hj9UaNnk
-
delay
3
-
download_payload
false
-
install
true
-
install_name
CandyDDoser-installer-15.4.1.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Voicemod\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/hj9UaNnk
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Limerat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation CandyDDoser-installer-15.4.1.exe -
Executes dropped EXE 1 IoCs
pid Process 4436 CandyDDoser-installer-15.4.1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 53 IoCs
flow ioc 91 pastebin.com 32 pastebin.com 62 pastebin.com 68 pastebin.com 82 pastebin.com 63 pastebin.com 94 pastebin.com 51 pastebin.com 67 pastebin.com 14 pastebin.com 22 pastebin.com 92 pastebin.com 23 pastebin.com 30 pastebin.com 49 pastebin.com 64 pastebin.com 80 pastebin.com 88 pastebin.com 85 pastebin.com 86 pastebin.com 90 pastebin.com 17 pastebin.com 46 pastebin.com 48 pastebin.com 56 pastebin.com 69 pastebin.com 21 pastebin.com 41 pastebin.com 66 pastebin.com 95 pastebin.com 96 pastebin.com 53 pastebin.com 65 pastebin.com 83 pastebin.com 93 pastebin.com 15 pastebin.com 31 pastebin.com 61 pastebin.com 77 pastebin.com 84 pastebin.com 55 pastebin.com 87 pastebin.com 20 pastebin.com 50 pastebin.com 54 pastebin.com 47 pastebin.com 52 pastebin.com 59 pastebin.com 76 pastebin.com 78 pastebin.com 81 pastebin.com 79 pastebin.com 89 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CandyDDoser-installer-15.4.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CandyDDoser-installer-15.4.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4552 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4436 CandyDDoser-installer-15.4.1.exe Token: SeDebugPrivilege 4436 CandyDDoser-installer-15.4.1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4552 4412 CandyDDoser-installer-15.4.1.exe 86 PID 4412 wrote to memory of 4552 4412 CandyDDoser-installer-15.4.1.exe 86 PID 4412 wrote to memory of 4552 4412 CandyDDoser-installer-15.4.1.exe 86 PID 4412 wrote to memory of 4436 4412 CandyDDoser-installer-15.4.1.exe 88 PID 4412 wrote to memory of 4436 4412 CandyDDoser-installer-15.4.1.exe 88 PID 4412 wrote to memory of 4436 4412 CandyDDoser-installer-15.4.1.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installer-15.4.1.exe"C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installer-15.4.1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Voicemod\CandyDDoser-installer-15.4.1.exe'"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4552
-
-
C:\Users\Admin\AppData\Roaming\Voicemod\CandyDDoser-installer-15.4.1.exe"C:\Users\Admin\AppData\Roaming\Voicemod\CandyDDoser-installer-15.4.1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709B
MD58a1197be130e48aa5aeeafd43eb6bb9f
SHA1cb790c7c216e41524348eaa0e5b74926e78dbfc6
SHA256547474087ec8f71dfd32b76f9b74c86f9844addf5082df37562a2c2c0cae4bfb
SHA5124ad9d8dbbc253c8d7b1c2b4ec5f115c770f02bdbbc21ca0b422e251a3a98331e169c5062cabf7da81d5ae0d295b3778ef105ef82709df1a4ace71be288b8f166
-
Filesize
28KB
MD5f73dfb6f1169032be3b281bfecd8e27a
SHA16b487113f260ed17b0a3b4c3ecab199e57c7d0bf
SHA2562278dd8c09c9f6967d1414a6254ea386fec564baea3956faeadca3a51eb0fddf
SHA512b2298c03be51d8681aad8a52bb703b5da70dc522f8765aadd2ae91680672079983b3345923687b2617aa240bd31f14bc9ad029ef87fbd91563b10f4d41b0a98f