limerat | 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
Size 78KB
Sample220512-nxrdzagadq
SHA256 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
MD5 259d498a10482929d3331458526047e5
SHA1 9808b64e9dee325393374884344b18e37570a135
SHA512 c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
MD5 SHA1 SHA512

Score

10^/10

limerat evasion persistence rat trojan

Malware Config

Extracted

Family

limerat

Attributes

aes_key
EIYV1V9YH5dE7u4B6kXr
antivm
true
c2_url
https://pastebin.com/raw/LtRQn6ir
delay
3
download_payload
false
install
true
install_name
mswebhook.exe
main_folder
AppData
pin_spread
false
sub_folder
\edge\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 2 IoCs

pid	Process
1148	mswebhook.exe
384	mswebhook.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mswebhook.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Edge\\mswebhook.exe"	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 1148 set thread context of 384	1148	mswebhook.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1092	schtasks.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 2476 wrote to memory of 4312	2476	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	83
PID 4312 wrote to memory of 1092	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	87
PID 4312 wrote to memory of 1092	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	87
PID 4312 wrote to memory of 1092	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	87
PID 4312 wrote to memory of 1148	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	90
PID 4312 wrote to memory of 1148	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	90
PID 4312 wrote to memory of 1148	4312	31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe	90
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92
PID 1148 wrote to memory of 384	1148	mswebhook.exe	92

C:\Users\Admin\AppData\Local\Temp\31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
"C:\Users\Admin\AppData\Local\Temp\31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:1092
- - C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe
    "C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328.exe.log
Size 418B
SHA256 bdb480893a7d1acc95b67f49dd12a0c1f69b75d1908536d0cc1350ebfbb5cc58
MD5 2f51ee33b74ab710e289b65a7b580c9b
SHA1 031f919473e89c4a463360c7a898fda986836470
SHA512 927bd82da2cc751b6b2c97efc33019b8977f2d78d467b363cf609e27a3ac8986e0b4c3b4d025be9fe87f50db51285b115b97ae7d0ae642daae2910d44ad9ec5a
MD5 SHA1 SHA512

Submit Download

mswebhook.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mswebhook.exe.log
Size 418B
SHA256 bdb480893a7d1acc95b67f49dd12a0c1f69b75d1908536d0cc1350ebfbb5cc58
MD5 2f51ee33b74ab710e289b65a7b580c9b
SHA1 031f919473e89c4a463360c7a898fda986836470
SHA512 927bd82da2cc751b6b2c97efc33019b8977f2d78d467b363cf609e27a3ac8986e0b4c3b4d025be9fe87f50db51285b115b97ae7d0ae642daae2910d44ad9ec5a
MD5 SHA1 SHA512

Submit Download

mswebhook.exe

Path C:\Users\Admin\AppData\Roaming\Edge\mswebhook.exe
Size 78KB
SHA256 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
MD5 259d498a10482929d3331458526047e5
SHA1 9808b64e9dee325393374884344b18e37570a135
SHA512 c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
SSDEEP 1536:MkeH1wzPeje9dZld4WwA2z7efZCJrChYZ1sCUpW7c:emmjWLdbwA2LJrQYZ1sCUpW7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

mswebhook.exe

Path C:\Users\Admin\AppData\Roaming\Edge\mswebhook.exe
Size 78KB
SHA256 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
MD5 259d498a10482929d3331458526047e5
SHA1 9808b64e9dee325393374884344b18e37570a135
SHA512 c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
SSDEEP 1536:MkeH1wzPeje9dZld4WwA2z7efZCJrChYZ1sCUpW7c:emmjWLdbwA2LJrQYZ1sCUpW7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

mswebhook.exe

Path C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe
Size 78KB
SHA256 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
MD5 259d498a10482929d3331458526047e5
SHA1 9808b64e9dee325393374884344b18e37570a135
SHA512 c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
SSDEEP 1536:MkeH1wzPeje9dZld4WwA2z7efZCJrChYZ1sCUpW7c:emmjWLdbwA2LJrQYZ1sCUpW7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

mswebhook.exe

Path C:\Users\Admin\AppData\Roaming\edge\mswebhook.exe
Size 78KB
SHA256 31e5ee4bfed3bc1e491d75bf07958d0141264d736fd25d883125054d4f4d9328
MD5 259d498a10482929d3331458526047e5
SHA1 9808b64e9dee325393374884344b18e37570a135
SHA512 c7dc6460662d59fbe319b56e5a401d2b642aaa6fb5d237ea7a68aaa6df9f39267a0e10ab6bad8156614b9051c9f7d6947d76999bbc313c3153ec8aca63e37ecb
SSDEEP 1536:MkeH1wzPeje9dZld4WwA2z7efZCJrChYZ1sCUpW7c:emmjWLdbwA2LJrQYZ1sCUpW7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2476-131-0x000000000B2E0000-0x000000000B884000-memory.dmp

Download

memory/2476-132-0x00000000015D0000-0x000000000166C000-memory.dmp

Download

memory/2476-130-0x0000000000D70000-0x0000000000D8C000-memory.dmp

Download

memory/4312-136-0x0000000005900000-0x0000000005966000-memory.dmp

Download

memory/4312-134-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads