limerat | 10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5

Analysis

max time kernel
149s
max time network
146s
platform
windows10_x64
resource
win10v20210410
submitted
07/05/2021, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe
Size 537KB
Sample210507-9dtefxsngn
SHA256 10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
MD5 e04ed1d1bfb04cb9a47a2f8b23613d3f
SHA1 294287a158af747c67c2d12d2359c8968ca5bdfd
SHA512 207165316fa0b18d36d2989b6ece2e0c1c8b3775171f2bb97b8ecea0a5c59c37f89f5af4fa2d4b580257a3a763c40708bc92a85464d7789ea6c5cbfa1e08fcc6
MD5 SHA1 SHA512

Score

10^/10

limerat oski infostealer rat spyware stealer

Malware Config

Extracted

Family

limerat

Wallets

1CUdxaF2Z2M9DewCbmhsJUwqDJCxMo7mcx

Attributes

aes_key
NYAN
antivm
false
c2_url
https://pastebin.com/raw/SkZ5tGQH
delay
3
download_payload
true
install
true
install_name
update.exe
main_folder
AppData
payload_url
http://bankschannelpub.com/wp-content/upgrade/dll.exe
pin_spread
false
sub_folder
\update\
usb_spread
false

Extracted

Family

oski

trafficbadassery.com/a/

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Executes dropped EXE 6 IoCs

pid	Process
2052	cmd Consol.exe
2356	Credit Card BIN Checker v1.0.0.exe
3580	dll.exe
3540	New-Client4.exe
3820	dll.com
2464	update.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	3820	WerFault.exe	80

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe
2464	update.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	cmd Consol.exe
Token: SeDebugPrivilege	3580	dll.exe
Token: SeDebugPrivilege	2464	update.exe
Token: SeDebugPrivilege	2464	update.exe
Token: SeRestorePrivilege	3196	WerFault.exe
Token: SeBackupPrivilege	3196	WerFault.exe
Token: SeDebugPrivilege	3196	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2052	780	10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe	75
PID 780 wrote to memory of 2052	780	10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe	75
PID 780 wrote to memory of 2356	780	10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe	76
PID 780 wrote to memory of 2356	780	10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe	76
PID 780 wrote to memory of 2356	780	10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe	76
PID 2052 wrote to memory of 3580	2052	cmd Consol.exe	78
PID 2052 wrote to memory of 3580	2052	cmd Consol.exe	78
PID 2052 wrote to memory of 3540	2052	cmd Consol.exe	79
PID 2052 wrote to memory of 3540	2052	cmd Consol.exe	79
PID 2052 wrote to memory of 3540	2052	cmd Consol.exe	79
PID 3580 wrote to memory of 3820	3580	dll.exe	80
PID 3580 wrote to memory of 3820	3580	dll.exe	80
PID 3580 wrote to memory of 3820	3580	dll.exe	80
PID 3540 wrote to memory of 1316	3540	New-Client4.exe	83
PID 3540 wrote to memory of 1316	3540	New-Client4.exe	83
PID 3540 wrote to memory of 1316	3540	New-Client4.exe	83
PID 3540 wrote to memory of 2464	3540	New-Client4.exe	85
PID 3540 wrote to memory of 2464	3540	New-Client4.exe	85
PID 3540 wrote to memory of 2464	3540	New-Client4.exe	85

C:\Users\Admin\AppData\Local\Temp\10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe
"C:\Users\Admin\AppData\Local\Temp\10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\cmd Consol.exe
  "C:\Users\Admin\AppData\Local\Temp\cmd Consol.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\dll.exe
    "C:\Users\Admin\AppData\Local\Temp\dll.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\dll.com
      "C:\Users\Admin\AppData\Local\Temp\dll.com"
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 1196
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
- - C:\Users\Admin\AppData\Local\Temp\New-Client4.exe
    "C:\Users\Admin\AppData\Local\Temp\New-Client4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\update\update.exe'"
      4⤵
      Creates scheduled task(s)
      PID:1316
  - - C:\Users\Admin\AppData\Roaming\update\update.exe
      "C:\Users\Admin\AppData\Roaming\update\update.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464
- C:\Users\Admin\AppData\Local\Temp\Credit Card BIN Checker v1.0.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Credit Card BIN Checker v1.0.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-128-0x0000000001350000-0x0000000001352000-memory.dmp

Download

memory/2052-131-0x0000000001380000-0x00000000013B0000-memory.dmp

Download

memory/2052-120-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/2356-125-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

Download

memory/2356-126-0x0000000008140000-0x0000000008141000-memory.dmp

Download

memory/2356-133-0x00000000054F3000-0x00000000054F5000-memory.dmp

Download

memory/2356-132-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/2356-122-0x0000000000C90000-0x0000000000C91000-memory.dmp

Download

memory/2356-130-0x0000000007E60000-0x0000000007E61000-memory.dmp

Download

memory/2356-129-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/2356-124-0x0000000007A70000-0x0000000007B9A000-memory.dmp

Download

memory/2356-127-0x0000000007C40000-0x0000000007C41000-memory.dmp

Download

memory/2464-161-0x0000000004FB0000-0x000000000504C000-memory.dmp

Download

memory/3540-150-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/3540-151-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download

memory/3540-142-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3580-148-0x0000000002960000-0x0000000002962000-memory.dmp

Download

memory/3580-149-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/3580-138-0x0000000000810000-0x0000000000811000-memory.dmp

Download