limerat | b4f0d107e95fa6f3aaae96d0341f0f0ad90b2dfa1fe7d9e04903eb2354a39ded

General

Target
567225e63d26da94a21764c2eeb3f656.exe
Size 1.1MB
Sample210622-k2n6qawlyj
SHA256 b4f0d107e95fa6f3aaae96d0341f0f0ad90b2dfa1fe7d9e04903eb2354a39ded
MD5 567225e63d26da94a21764c2eeb3f656
SHA1 a59f68653a471800ea9cd454eb4871b31c9cd192
SHA512 7df3f533bac6013ce09128310216a22cd5f8d513ecc4baf16f487d8b7b26ce0e4e67452c7d584c37fe99e0bf5517b06704af08f51cb89ea1de4a57dc696a5071
MD5 SHA1 SHA512

Score

10^/10

limerat rat

Family

Wallets

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 472	1668	567225e63d26da94a21764c2eeb3f656.exe	29
PID 1668 wrote to memory of 472	1668	567225e63d26da94a21764c2eeb3f656.exe	29
PID 1668 wrote to memory of 472	1668	567225e63d26da94a21764c2eeb3f656.exe	29
PID 1668 wrote to memory of 472	1668	567225e63d26da94a21764c2eeb3f656.exe	29
PID 1668 wrote to memory of 576	1668	567225e63d26da94a21764c2eeb3f656.exe	31
PID 1668 wrote to memory of 576	1668	567225e63d26da94a21764c2eeb3f656.exe	31
PID 1668 wrote to memory of 576	1668	567225e63d26da94a21764c2eeb3f656.exe	31
PID 1668 wrote to memory of 576	1668	567225e63d26da94a21764c2eeb3f656.exe	31
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32
PID 1668 wrote to memory of 712	1668	567225e63d26da94a21764c2eeb3f656.exe	32

C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe
"C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZvWAdimvGBUdre" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4BF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:472
- C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe
  "C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe"
  2⤵
  PID:576
- C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe
  "C:\Users\Admin\AppData\Local\Temp\567225e63d26da94a21764c2eeb3f656.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:712