limerat | 7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4

General

Target
7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe
Size 1.1MB
Sample220511-cyhmnsgcgm
SHA256 7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4
MD5 2d768a20d0d4979a7fb7d038081328b6
SHA1 8a25e11047af6310bfeb933cbb57d30d61e6b11d
SHA512 698015ee9ed4d357f33fb0e066212d264ce8e281f79ff3aa50ada0193adb397994df83ed42d0ad2878ec0e3aed8fd1b5b5ee9ac242e1d11e6367c66ec8ca0dbf
MD5 SHA1 SHA512

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty

Attributes

aes_key
nulled
antivm
true
c2_url
https://pastebin.com/raw/cXuQ0V20
delay
3
download_payload
false
install
false
install_name
Winservices.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
2876	sdchange.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	sdchange.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RegAsm.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000023170-137.dat	autoit_exe
behavioral2/files/0x0006000000023170-138.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 2876 set thread context of 4388	2876	sdchange.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4908	schtasks.exe
2024	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	RegAsm.exe
Token: SeDebugPrivilege	1456	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 4616 wrote to memory of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 4616 wrote to memory of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 4616 wrote to memory of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 4616 wrote to memory of 1456	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	81
PID 4616 wrote to memory of 4908	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	82
PID 4616 wrote to memory of 4908	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	82
PID 4616 wrote to memory of 4908	4616	7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe	82
PID 2876 wrote to memory of 4388	2876	sdchange.exe	93
PID 2876 wrote to memory of 4388	2876	sdchange.exe	93
PID 2876 wrote to memory of 4388	2876	sdchange.exe	93
PID 2876 wrote to memory of 4388	2876	sdchange.exe	93
PID 2876 wrote to memory of 4388	2876	sdchange.exe	93
PID 2876 wrote to memory of 2024	2876	sdchange.exe	94
PID 2876 wrote to memory of 2024	2876	sdchange.exe	94
PID 2876 wrote to memory of 2024	2876	sdchange.exe	94

C:\Users\Admin\AppData\Local\Temp\7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe
"C:\Users\Admin\AppData\Local\Temp\7719ad9b0562f347fc8096f76f7a085d21c2285afee4ff1d96977be0a25868e4.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4908

C:\Users\Admin\secinit\sdchange.exe
C:\Users\Admin\secinit\sdchange.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4388
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sdchange.exe

Path C:\Users\Admin\secinit\sdchange.exe
Size 1.1MB
SHA256 03cb60e31812071acb05afa91bec699bd308443721e213fc9cd1c36fe902e679
MD5 c19f6694365599a098b411018d3159df
SHA1 a1edc99c989e0b2510702efbc01242db53f23c04
SHA512 761e4253dd962fbcfb544e5aabe9081fd75c849b2df0de1ee515e3c400ee286ad7c15077a1e1abebf0ded45872716a41abb4a0e80a8c897757c876f4e950c6fe
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa97aWtjzjFtuM25s:/h+ZkldoPK8Ya971XjFtAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdchange.exe

Path C:\Users\Admin\secinit\sdchange.exe
Size 1.1MB
SHA256 03cb60e31812071acb05afa91bec699bd308443721e213fc9cd1c36fe902e679
MD5 c19f6694365599a098b411018d3159df
SHA1 a1edc99c989e0b2510702efbc01242db53f23c04
SHA512 761e4253dd962fbcfb544e5aabe9081fd75c849b2df0de1ee515e3c400ee286ad7c15077a1e1abebf0ded45872716a41abb4a0e80a8c897757c876f4e950c6fe
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa97aWtjzjFtuM25s:/h+ZkldoPK8Ya971XjFtAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-131-0x0000000000620000-0x000000000062C000-memory.dmp

Download

memory/1456-135-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/4388-140-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4388-145-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads