Overview

overview

7

Static

static

3

IZ_LiveLet.exe

windows10-2004-x64

5

IZ_LiveLet.exe

windows11-21h2-x64

5

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LiveLet.exe

windows10-2004-x64

3

LiveLet.exe

windows11-21h2-x64

3

Livecare_a...ce.exe

windows10-2004-x64

4

Livecare_a...ce.exe

windows11-21h2-x64

4

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

lcaresrv/ISHooks.dll

windows10-2004-x64

3

lcaresrv/ISHooks.dll

windows11-21h2-x64

3

lcaresrv/I...64.dll

windows10-2004-x64

1

lcaresrv/I...64.dll

windows11-21h2-x64

1

lcaresrv/i...64.exe

windows10-2004-x64

1

lcaresrv/i...64.exe

windows11-21h2-x64

1

lcaresrv/ishsrv.exe

windows10-2004-x64

3

lcaresrv/ishsrv.exe

windows11-21h2-x64

3

Livecare_demo.exe

windows10-2004-x64

3

Livecare_demo.exe

windows11-21h2-x64

3

lcareview/ishview.exe

windows10-2004-x64

3

lcareview/ishview.exe

windows11-21h2-x64

3

Livecare_service.exe

windows10-2004-x64

3

Livecare_service.exe

windows11-21h2-x64

3

$APPDATA/L...or.exe

windows10-2004-x64

7

$APPDATA/L...or.exe

windows11-21h2-x64

3

$APPDATA/L...et.exe

windows10-2004-x64

3

$APPDATA/L...et.exe

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    IZ_LiveLet.exe
  • Size 8.4MB
  • Sample260602-anvs5sa18n
  • SHA256 b98477bb6c6945e25f2293456c47c625dfb2296f467716ecf61d81f991f74d2f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstallerprivilege_escalation

Malware Config

Targets

    • Target
      IZ_LiveLet.exe
    • Size 8.4MB
    • SHA256 b98477bb6c6945e25f2293456c47c625dfb2296f467716ecf61d81f991f74d2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    defense_evasiondiscoveryinstallerprivilege_escalation

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      LiveLet.exe
    • Size 11.7MB
    • SHA256 9c7875f32761176319ddc06180953a8d5b9c0bf13aaaf7c79fcdd98e3fd9813a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Livecare_assistance.exe
    • Size 1.9MB
    • SHA256 66f9c03e6cede3672733babbe9a14ec96ade883116c95f9a16614cbe06d27ee9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      lcaresrv/ISHooks.dll
    • Size 169KB
    • SHA256 6338a0641e94cd96165d92532e912ea0ea0ad373bf18b45fa914079cacd449cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      lcaresrv/ISHooks64.dll
    • Size 138KB
    • SHA256 3ee334fb7b74c833193fe9dac0083d25daf1472395d48fd32e97adbc5b96afc9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      lcaresrv/ishooks64.exe
    • Size 75KB
    • SHA256 e2a667a696284034931570630d2449702583248d7373c810d00c1a438927b6b0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      lcaresrv/ishsrv.exe
    • Size 4.7MB
    • SHA256 bef97a5186307b61f7bd5203766a88cb58f57fe64c85f3a6cda9ec55022f6bf3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      Livecare_demo.exe
    • Size 717KB
    • SHA256 c044a7fc9ef3bf29b26c39cdb3f1076d255a1a223de7ac3ee297464266c007d2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      lcareview/ishview.exe
    • Size 1.6MB
    • SHA256 2cf3c55761415a56c4e69614acc977c83d1dcccf76b431b7c1a0887dbd0773a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      Livecare_service.exe
    • Size 930KB
    • SHA256 5e921ee9aa1fdfaa35ff84b6611293ec02bfbcd5f9e2cde2381cb43e28aacb75
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      $APPDATA/Livecare/service/LivecareElevator.exe
    • Size 215KB
    • SHA256 07ad95b6bc3cebbcb34d50a845be303fd98cf91c5f2fb46320c7276dcd5f85b0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral25behavioral26
    • Target
      $APPDATA/Livecare/service/LivecareServiceLivelet.exe
    • Size 2.0MB
    • SHA256 1265a106b8ecdd3f4fcdea7d1b54eed44cc2247b0cf2902608453aef4db17784
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28

MITRE ATT&CK Enterprise v16

Tasks

static1

installer
Score
3/10

behavioral1

defense_evasiondiscoveryinstallerprivilege_escalation
Score
5/10

behavioral2

defense_evasiondiscoveryinstallerprivilege_escalation
Score
5/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
4/10

behavioral8

discovery
Score
4/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10