limerat | df6fa5b55c8196df0a53575cd26f5a7e53146899d41ab1a1a3acdb320f185d1f

Analysis

max time kernel
121s
max time network
133s
platform
windows10_x64
resource
win10-en-20211014
submitted
03-11-2021 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e45c3146bebd87ccef96e054374ea11.exe
Size

645KB
MD5

2e45c3146bebd87ccef96e054374ea11
SHA1

f2be6622242c311beb54f984c2fd85b865c2431c
SHA256

df6fa5b55c8196df0a53575cd26f5a7e53146899d41ab1a1a3acdb320f185d1f
SHA512

4277153eaea844fdcd1ab7920d290f7a877a2a46e6d71b5b962f445395e7c0299e859409fb52e96920bc31ab6d7ed2be81e69021c0145585984dc57c76469b51

Score

10^/10

limerat parallax persistence rat

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000400000001aba1-123.dat	disable_win_def
behavioral2/files/0x000400000001aba1-124.dat	disable_win_def

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\security\\wowreg32.exe\""	2e45c3146bebd87ccef96e054374ea11.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\security\\wowreg32.exe\""	wowreg32.exe

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	wowreg32.exe

Executes dropped EXE 1 IoCs

pid	Process
2376	wowreg32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	2376	WerFault.exe	76

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3464	schtasks.exe
2832	schtasks.exe
2028	schtasks.exe
1352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	2e45c3146bebd87ccef96e054374ea11.exe
2724	2e45c3146bebd87ccef96e054374ea11.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe
2376	wowreg32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	2e45c3146bebd87ccef96e054374ea11.exe
Token: SeBackupPrivilege	2724	2e45c3146bebd87ccef96e054374ea11.exe
Token: SeSecurityPrivilege	2724	2e45c3146bebd87ccef96e054374ea11.exe
Token: SeBackupPrivilege	2724	2e45c3146bebd87ccef96e054374ea11.exe
Token: SeDebugPrivilege	2376	wowreg32.exe
Token: SeDebugPrivilege	2376	wowreg32.exe
Token: SeShutdownPrivilege	3044	WerFault.exe
Token: SeDebugPrivilege	3044	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	wowreg32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1580	2724	2e45c3146bebd87ccef96e054374ea11.exe	70
PID 2724 wrote to memory of 1580	2724	2e45c3146bebd87ccef96e054374ea11.exe	70
PID 2724 wrote to memory of 1016	2724	2e45c3146bebd87ccef96e054374ea11.exe	72
PID 2724 wrote to memory of 1016	2724	2e45c3146bebd87ccef96e054374ea11.exe	72
PID 1580 wrote to memory of 3464	1580	cmd.exe	73
PID 1580 wrote to memory of 3464	1580	cmd.exe	73
PID 1016 wrote to memory of 2832	1016	cmd.exe	75
PID 1016 wrote to memory of 2832	1016	cmd.exe	75
PID 2724 wrote to memory of 2376	2724	2e45c3146bebd87ccef96e054374ea11.exe	76
PID 2724 wrote to memory of 2376	2724	2e45c3146bebd87ccef96e054374ea11.exe	76
PID 2376 wrote to memory of 2028	2376	wowreg32.exe	77
PID 2376 wrote to memory of 2028	2376	wowreg32.exe	77
PID 2376 wrote to memory of 1352	2376	wowreg32.exe	79
PID 2376 wrote to memory of 1352	2376	wowreg32.exe	79

C:\Users\Admin\AppData\Local\Temp\2e45c3146bebd87ccef96e054374ea11.exe
"C:\Users\Admin\AppData\Local\Temp\2e45c3146bebd87ccef96e054374ea11.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C schtasks /create /f /st "18:31" /sc weekly /mo "24" /d "Sun" /tn "Intel TXE" /tr "'explorer'http://bit.ly/2sabzMS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /st "18:31" /sc weekly /mo "24" /d "Sun" /tn "Intel TXE" /tr "'explorer'http://bit.ly/2sabzMS"
    3⤵
    - Creates scheduled task(s)
    PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C schtasks /create /f /st "12:25" /sc monthly /m "sep" /tn "Microsoft-Windows-DiskDiagnosticResolver" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /st "12:25" /sc monthly /m "sep" /tn "Microsoft-Windows-DiskDiagnosticResolver" /tr "'explorer'https://bit.ly/3iVN7Vd"
    3⤵
    - Creates scheduled task(s)
    PID:2832
- C:\Users\Admin\AppData\Roaming\security\wowreg32.exe
  "C:\Users\Admin\AppData\Roaming\security\wowreg32.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /st "21:53" /sc daily /mo "3" /tn "" /tr "'explorer'C_Settings.URL1"
    3⤵
    - Creates scheduled task(s)
    PID:2028
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /st "06:30" /sc daily /mo "7" /tn "" /tr "'explorer'C_Settings.URL2"
    3⤵
    - Creates scheduled task(s)
    PID:1352
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2376 -s 3732
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-130-0x0000000003052000-0x0000000003054000-memory.dmp

Filesize
8KB

Download
memory/2376-136-0x000000001D394000-0x000000001D397000-memory.dmp

Filesize
12KB

Download
memory/2376-141-0x000000001D39B000-0x000000001D39E000-memory.dmp

Filesize
12KB

Download
memory/2376-127-0x0000000003050000-0x0000000003052000-memory.dmp

Filesize
8KB

Download
memory/2376-139-0x000000001D3A1000-0x000000001D3A6000-memory.dmp

Filesize
20KB

Download
memory/2376-140-0x000000001D3A6000-0x000000001D3AB000-memory.dmp

Filesize
20KB

Download
memory/2376-138-0x000000001D39C000-0x000000001D3A1000-memory.dmp

Filesize
20KB

Download
memory/2376-131-0x0000000003054000-0x0000000003056000-memory.dmp

Filesize
8KB

Download
memory/2376-133-0x0000000003058000-0x000000000305A000-memory.dmp

Filesize
8KB

Download
memory/2376-132-0x0000000003056000-0x0000000003058000-memory.dmp

Filesize
8KB

Download
memory/2376-134-0x000000000305A000-0x000000000305F000-memory.dmp

Filesize
20KB

Download
memory/2376-135-0x000000001D390000-0x000000001D394000-memory.dmp

Filesize
16KB

Download
memory/2376-137-0x000000001D397000-0x000000001D39C000-memory.dmp

Filesize
20KB

Download
memory/2724-115-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2724-117-0x000000001AF30000-0x000000001AF32000-memory.dmp

Filesize
8KB

Download