Play interactive tour

Edit tour

Analysis Report 02hcrdNuG6.exe

Overview

General Information

Sample Name:	02hcrdNuG6.exe
Analysis ID:	399834
MD5:	4358ed0c3918c0658a1b2bb1bc35462d
SHA1:	728017a96e30fe41379ed36a1c9b3129751f3750
SHA256:	a81addf8ad395ae36a617da9fb138337c17941475c1e3f3003d2571c8cb3b84e
Infos:
Most interesting Screenshot:

Detection

LimeRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected LimeRAT

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Startup

System is w10x64

02hcrdNuG6.exe (PID: 5480 cmdline: 'C:\Users\user\Desktop\02hcrdNuG6.exe' MD5: 4358ED0C3918C0658A1B2BB1BC35462D)

schtasks.exe (PID: 6152 cmdline: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr ''C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe'' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WindowsService.exe (PID: 6236 cmdline: 'C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe' MD5: 4358ED0C3918C0658A1B2BB1BC35462D)

WindowsService.exe (PID: 6368 cmdline: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe MD5: 4358ED0C3918C0658A1B2BB1BC35462D)

cleanup

Malware Configuration

Threatname: LimeRAT

{"C2 url": "https://pastebin.com/raw/FQ6Mj5L5", "AES Key": "CrackingG0d", "ENDOF": "|'N'|", "Seprator": "|'L'|", "Install File": "WindowsService.exe", "Install Dir": "temp", "Version": "v0.1.9.2"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
02hcrdNuG6.exe	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.227121610.0000000000852000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000006.00000000.247272904.0000000000B42000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000005.00000000.245889872.0000000000742000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000000.00000002.246717553.0000000002B3C000.00000004.00000001.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000005.00000002.495518458.0000000000742000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000006.00000002.261807095.0000000000B42000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
00000000.00000002.246107724.0000000000852000.00000002.00020000.sdmp	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
Process Memory Space: 02hcrdNuG6.exe PID: 5480	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
Process Memory Space: WindowsService.exe PID: 6236	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
Process Memory Space: WindowsService.exe PID: 6368	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.02hcrdNuG6.exe.850000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
6.0.WindowsService.exe.b40000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
0.2.02hcrdNuG6.exe.2b3c494.1.raw.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
6.2.WindowsService.exe.b40000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
5.0.WindowsService.exe.740000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
0.0.02hcrdNuG6.exe.850000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
5.2.WindowsService.exe.740000.0.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
0.2.02hcrdNuG6.exe.2b3c494.1.unpack	JoeSecurity_LimeRAT	Yara detected LimeRAT	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: 02hcrdNuG6.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Avira: detection malicious, Label: TR/Spy.Gen8

Found malware configuration

Show sources

Source: 5.0.WindowsService.exe.740000.0.unpack

Malware Configuration Extractor: LimeRAT {"C2 url": "https://pastebin.com/raw/FQ6Mj5L5", "AES Key": "CrackingG0d", "ENDOF": "|'N'|", "Seprator": "|'L'|", "Install File": "WindowsService.exe", "Install Dir": "temp", "Version": "v0.1.9.2"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Metadefender: Detection: 48%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Show sources

Source: 02hcrdNuG6.exe	Metadefender: Detection: 48%			Perma Link
Source: 02hcrdNuG6.exe	ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 02hcrdNuG6.exe

Joe Sandbox ML: detected

Source: 02hcrdNuG6.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.5:49714 version: TLS 1.0

Source: 02hcrdNuG6.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://pastebin.com/raw/FQ6Mj5L5

Connects to a pastebin service (likely for C&C)

Show sources

Source: unknown

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.5:49716 -> 134.255.220.10:555

Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190
Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.5:49714 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.220.10

Source: unknown

DNS traffic detected: queries for: pastebin.com

Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0L
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: WindowsService.exe, 00000005.00000002.498465437.0000000002A19000.00000004.00000001.sdmp	String found in binary or memory: http://pastebin.com
Source: 02hcrdNuG6.exe, 00000000.00000002.246691900.0000000002B21000.00000004.00000001.sdmp, WindowsService.exe, 00000005.00000002.498378776.00000000029DC000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WindowsService.exe, 00000005.00000002.498378776.00000000029DC000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com
Source: WindowsService.exe, 00000005.00000002.498744035.0000000002B00000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw/FQ6Mj5L5
Source: WindowsService.exe, 00000005.00000002.498744035.0000000002B00000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.comD8
Source: WindowsService.exe, 00000005.00000002.498586566.0000000002A5A000.00000004.00000001.sdmp, WindowsService.exe, 00000005.00000002.498465437.0000000002A19000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected LimeRAT

Show sources

Source: Yara match	File source: 02hcrdNuG6.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.227121610.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.247272904.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.245889872.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246717553.0000000002B3C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.495518458.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.261807095.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246107724.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 02hcrdNuG6.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6236, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6368, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe, type: DROPPED
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.unpack, type: UNPACKEDPE

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Operating System Destruction:

Protects its processes via BreakOnTermination flag

Show sources

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Process information set: 01 00 00 00

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Code function: 0_2_02A0B0B8	0_2_02A0B0B8
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Code function: 0_2_02A0D068	0_2_02A0D068
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Code function: 0_2_02A0A4A0	0_2_02A0A4A0
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Code function: 0_2_02A0A7E8	0_2_02A0A7E8
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 5_2_0105B0B8	5_2_0105B0B8
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 5_2_0105A4A0	5_2_0105A4A0
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 5_2_0105A7E8	5_2_0105A7E8
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 6_2_014DD078	6_2_014DD078
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 6_2_014DB0B8	6_2_014DB0B8
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 6_2_014DA4A0	6_2_014DA4A0
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Code function: 6_2_014DA7E8	6_2_014DA7E8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe A81ADDF8AD395AE36A617DA9FB138337C17941475C1E3F3003D2571C8CB3B84E

Source: 02hcrdNuG6.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 02hcrdNuG6.exe, ??????????/????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 02hcrdNuG6.exe, ??????????/????????.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: WindowsService.exe.0.dr, ??????????/????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WindowsService.exe.0.dr, ??????????/????????.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.02hcrdNuG6.exe.850000.0.unpack, ??????????/????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.02hcrdNuG6.exe.850000.0.unpack, ??????????/????????.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.2.02hcrdNuG6.exe.850000.0.unpack, ??????????/????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.02hcrdNuG6.exe.850000.0.unpack, ??????????/????????.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: 02hcrdNuG6.exe, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: WindowsService.exe.0.dr, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 0.0.02hcrdNuG6.exe.850000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 0.2.02hcrdNuG6.exe.850000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 5.0.WindowsService.exe.740000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 5.2.WindowsService.exe.740000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 6.0.WindowsService.exe.b40000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'
Source: 6.2.WindowsService.exe.b40000.0.unpack, ????????/??????????????.cs	Base64 encoded string: 'lIV5OVWm5X9grmK3OIzJ8FuDYpl793CoGrCN/6zL647Vo7Ubht0KB0YlAoEguiQR'

Source: WindowsService.exe.0.dr, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: WindowsService.exe.0.dr, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.2.WindowsService.exe.b40000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.2.WindowsService.exe.b40000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.WindowsService.exe.740000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.WindowsService.exe.740000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.WindowsService.exe.b40000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.WindowsService.exe.b40000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.02hcrdNuG6.exe.850000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.02hcrdNuG6.exe.850000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.WindowsService.exe.740000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.WindowsService.exe.740000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.02hcrdNuG6.exe.850000.0.unpack, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.2.02hcrdNuG6.exe.850000.0.unpack, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 02hcrdNuG6.exe, ?????????/??????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 02hcrdNuG6.exe, ?????????/??????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@1/2

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\02hcrdNuG6.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6176:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Mutant created: \Sessions\1\BaseNamedObjects\925304F8E788

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File created: C:\Users\user\AppData\Local\Temp\Windows

Jump to behavior

Source: 02hcrdNuG6.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 02hcrdNuG6.exe	Metadefender: Detection: 48%
Source: 02hcrdNuG6.exe	ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File read: C:\Users\user\Desktop\02hcrdNuG6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\02hcrdNuG6.exe 'C:\Users\user\Desktop\02hcrdNuG6.exe'
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr ''C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe''
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process created: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe 'C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr ''C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe''	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process created: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe 'C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe'	Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 02hcrdNuG6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 02hcrdNuG6.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

Code function: 0_2_02A0C070 push 0000005Eh; ret

0_2_02A0C096

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File created: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Jump to dropped file

Boot Survival:

Yara detected LimeRAT

Show sources

Source: Yara match	File source: 02hcrdNuG6.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.227121610.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.247272904.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.245889872.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246717553.0000000002B3C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.495518458.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.261807095.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246107724.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 02hcrdNuG6.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6236, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6368, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe, type: DROPPED
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.unpack, type: UNPACKEDPE

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr ''C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe''

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File opened: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected LimeRAT

Show sources

Source: Yara match	File source: 02hcrdNuG6.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.227121610.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.247272904.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.245889872.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246717553.0000000002B3C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.495518458.0000000000742000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.261807095.0000000000B42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246107724.0000000000852000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 02hcrdNuG6.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6236, type: MEMORY
Source: Yara match	File source: Process Memory Space: WindowsService.exe PID: 6368, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe, type: DROPPED
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.WindowsService.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.02hcrdNuG6.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.WindowsService.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.02hcrdNuG6.exe.2b3c494.1.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\02hcrdNuG6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: WindowsService.exe, 02hcrdNuG6.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\02hcrdNuG6.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe

Window / User API: threadDelayed 1636

Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe TID: 6060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe TID: 6508	Thread sleep time: -81800s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\02hcrdNuG6.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Windows\WindowsService.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: WindowsService.exe, 00000005.00000002.503301465.00000000069FE000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareROCCZ3Y3Win32_VideoController1LZYUHYHVideoController120060621000000.000000-0001822.241display.infMSBDAKLCB9GXNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsHOP88G9N'
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: WindowsService.exe, 00000005.00000002.496372467.0000000000C34000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareROCCZ3Y3Win32_VideoController1LZYUHYHVideoController120060621000000.000000-0001822.241display.infMSBDAKLCB9GXNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsHOP88G9NG2
Source: WindowsService.exe, 00000005.00000002.503222070.0000000006960000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareROCCZ3Y3Win32_VideoController1LZYU
Source: 02hcrdNuG6.exe	Binary or memory string: vmware
Source: WindowsService.exe	Binary or memory string: \vboxhook.dll
Source: WindowsService.exe, 00000005.00000002.496372467.0000000000C34000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareROCCZ3Y3Win32_VideoController1LZYUHYHVideoController120060621000000.000000-0001822.241display.infMSBDAKLCB9GXNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsHOP88G9N!4
Source: 02hcrdNuG6.exe	Binary or memory string: \vboxhook.dllQY21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCA=
Source: WindowsService.exe, 00000005.00000002.496372467.0000000000C34000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareROCCZ3Y3Win32_VideoController1LZYUHYHVideoController120060621000000.000000-0001822.241display.infMSBDAKLCB9GXNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsHOP88G9N
Source: WindowsService.exe, 00000005.00000002.503301465.00000000069FE000.00000004.00000001.sdmp	Binary or memory string: (Standard display types)VMwareROCCZ3Y3Win32_VideoC"
Source: 02hcrdNuG6.exe, 00000000.00000002.246488614.0000000000EA4000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:I

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 02hcrdNuG6.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: LimeRAT

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Operating System Destruction:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging: