ScreenShot
| Created | 2022.12.13 09:52 | Machine | s1_win7_x6403 |
| Filename | LIMSt.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 49 detected (Coins, malicious, high confidence, GenericKDZ, Unsafe, Vetn, TrojanPSW, ABRisk, UPPS, Attribute, HighConfidence, a variant of WinGo, jtpdda, score, QQPass, QQRob, Bnhl, tovmp, Genkd, PSWTroj, kcloud, Sabsik, Vigorf, Detected, Artemis, ai score=84, Chgt, R002H0CKU22, CLOUD, TurtleLoader, susgen, PossibleThreat) | ||
| md5 | b26439eb7f5e2a7f1e2dabcfa8e3a7b1 | ||
| sha256 | 47a40add511868171afab04d336c6120be951799b6230fdbd581e6469e1a088e | ||
| ssdeep | 49152:EW32/5cuXfOG+CwXxDebqytiJCaLsL6M8Aoek1d:anXWRxDQqCLd8AK | ||
| imphash | 9cbefe68f395e67356e2a5d8d1b285c0 | ||
| impfuzzy | 24:UbVjhNwO+VuT2oLtXOr6kwmDruMztxdEr6tP:KwO+VAXOmGx0oP | ||
Network IP location
Signature (18cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| watch | Appends a known multi-family ransomware file extension to files that have been encrypted |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| watch | Harvests credentials from local email clients |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | One or more potentially interesting buffers were extracted |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x6b0220 WriteFile
0x6b0228 WriteConsoleW
0x6b0230 WaitForMultipleObjects
0x6b0238 WaitForSingleObject
0x6b0240 VirtualQuery
0x6b0248 VirtualFree
0x6b0250 VirtualAlloc
0x6b0258 SwitchToThread
0x6b0260 SuspendThread
0x6b0268 SetWaitableTimer
0x6b0270 SetUnhandledExceptionFilter
0x6b0278 SetProcessPriorityBoost
0x6b0280 SetEvent
0x6b0288 SetErrorMode
0x6b0290 SetConsoleCtrlHandler
0x6b0298 ResumeThread
0x6b02a0 PostQueuedCompletionStatus
0x6b02a8 LoadLibraryA
0x6b02b0 LoadLibraryW
0x6b02b8 SetThreadContext
0x6b02c0 GetThreadContext
0x6b02c8 GetSystemInfo
0x6b02d0 GetSystemDirectoryA
0x6b02d8 GetStdHandle
0x6b02e0 GetQueuedCompletionStatusEx
0x6b02e8 GetProcessAffinityMask
0x6b02f0 GetProcAddress
0x6b02f8 GetEnvironmentStringsW
0x6b0300 GetConsoleMode
0x6b0308 FreeEnvironmentStringsW
0x6b0310 ExitProcess
0x6b0318 DuplicateHandle
0x6b0320 CreateWaitableTimerExW
0x6b0328 CreateThread
0x6b0330 CreateIoCompletionPort
0x6b0338 CreateFileA
0x6b0340 CreateEventA
0x6b0348 CloseHandle
0x6b0350 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x6b0220 WriteFile
0x6b0228 WriteConsoleW
0x6b0230 WaitForMultipleObjects
0x6b0238 WaitForSingleObject
0x6b0240 VirtualQuery
0x6b0248 VirtualFree
0x6b0250 VirtualAlloc
0x6b0258 SwitchToThread
0x6b0260 SuspendThread
0x6b0268 SetWaitableTimer
0x6b0270 SetUnhandledExceptionFilter
0x6b0278 SetProcessPriorityBoost
0x6b0280 SetEvent
0x6b0288 SetErrorMode
0x6b0290 SetConsoleCtrlHandler
0x6b0298 ResumeThread
0x6b02a0 PostQueuedCompletionStatus
0x6b02a8 LoadLibraryA
0x6b02b0 LoadLibraryW
0x6b02b8 SetThreadContext
0x6b02c0 GetThreadContext
0x6b02c8 GetSystemInfo
0x6b02d0 GetSystemDirectoryA
0x6b02d8 GetStdHandle
0x6b02e0 GetQueuedCompletionStatusEx
0x6b02e8 GetProcessAffinityMask
0x6b02f0 GetProcAddress
0x6b02f8 GetEnvironmentStringsW
0x6b0300 GetConsoleMode
0x6b0308 FreeEnvironmentStringsW
0x6b0310 ExitProcess
0x6b0318 DuplicateHandle
0x6b0320 CreateWaitableTimerExW
0x6b0328 CreateThread
0x6b0330 CreateIoCompletionPort
0x6b0338 CreateFileA
0x6b0340 CreateEventA
0x6b0348 CloseHandle
0x6b0350 AddVectoredExceptionHandler
EAT(Export Address Table) is none