limerat | 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc

General

Target
1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe
Size 25KB
Sample220516-pq3dbsbfa4
SHA256 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc
MD5 f1d2e41f8975a9bc0398b6ae1240a27b
SHA1 398a0d64048a75a3be2dcc7e1c3a605aab3fb757
SHA512 9c4bc2556f57732b756f989e55ec6ef98deab1160edc3276c3347cc101048e0fae5ab4ef589f6d8463b02d0d6ff85d92ab47c56418d0d8e1d72b1a4b686f83c5
MD5 SHA1 SHA512

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

14dRaUuiR6xkQW6oD9ZQz1vLRDHNsediFi

Attributes

aes_key
retik
antivm
false
c2_url
https://pastebin.com/raw/rtpWLvAD
delay
3
download_payload
false
install
true
install_name
systry.exe
main_folder
AppData
pin_spread
true
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
1688	systry.exe

Loads dropped DLL 2 IoCs

pid	Process
904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe
904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1692	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	systry.exe
Token: SeDebugPrivilege	1688	systry.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1692	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	29
PID 904 wrote to memory of 1692	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	29
PID 904 wrote to memory of 1692	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	29
PID 904 wrote to memory of 1692	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	29
PID 904 wrote to memory of 1688	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	30
PID 904 wrote to memory of 1688	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	30
PID 904 wrote to memory of 1688	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	30
PID 904 wrote to memory of 1688	904	1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe	30

C:\Users\Admin\AppData\Local\Temp\1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe
"C:\Users\Admin\AppData\Local\Temp\1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\systry.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:1692
- C:\Users\Admin\AppData\Roaming\systry.exe
  "C:\Users\Admin\AppData\Roaming\systry.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systry.exe

Path C:\Users\Admin\AppData\Roaming\systry.exe
Size 25KB
SHA256 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc
MD5 f1d2e41f8975a9bc0398b6ae1240a27b
SHA1 398a0d64048a75a3be2dcc7e1c3a605aab3fb757
SHA512 9c4bc2556f57732b756f989e55ec6ef98deab1160edc3276c3347cc101048e0fae5ab4ef589f6d8463b02d0d6ff85d92ab47c56418d0d8e1d72b1a4b686f83c5
SSDEEP 384:3E0WnRVhrGmNvpo6faDh9as5QPJp388Pt84kDGlzCTJEUmNY9bro3lcx2YDW:qhL+6i99uPJp3KatNXnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

systry.exe

Path C:\Users\Admin\AppData\Roaming\systry.exe
Size 25KB
SHA256 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc
MD5 f1d2e41f8975a9bc0398b6ae1240a27b
SHA1 398a0d64048a75a3be2dcc7e1c3a605aab3fb757
SHA512 9c4bc2556f57732b756f989e55ec6ef98deab1160edc3276c3347cc101048e0fae5ab4ef589f6d8463b02d0d6ff85d92ab47c56418d0d8e1d72b1a4b686f83c5
SSDEEP 384:3E0WnRVhrGmNvpo6faDh9as5QPJp388Pt84kDGlzCTJEUmNY9bro3lcx2YDW:qhL+6i99uPJp3KatNXnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

systry.exe

Path \Users\Admin\AppData\Roaming\systry.exe
Size 25KB
SHA256 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc
MD5 f1d2e41f8975a9bc0398b6ae1240a27b
SHA1 398a0d64048a75a3be2dcc7e1c3a605aab3fb757
SHA512 9c4bc2556f57732b756f989e55ec6ef98deab1160edc3276c3347cc101048e0fae5ab4ef589f6d8463b02d0d6ff85d92ab47c56418d0d8e1d72b1a4b686f83c5
SSDEEP 384:3E0WnRVhrGmNvpo6faDh9as5QPJp388Pt84kDGlzCTJEUmNY9bro3lcx2YDW:qhL+6i99uPJp3KatNXnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

systry.exe

Path \Users\Admin\AppData\Roaming\systry.exe
Size 25KB
SHA256 1c2555c644bccfff0e5565f437e6b6c54dcb3ef5cba5f1dccc702bf179df2cbc
MD5 f1d2e41f8975a9bc0398b6ae1240a27b
SHA1 398a0d64048a75a3be2dcc7e1c3a605aab3fb757
SHA512 9c4bc2556f57732b756f989e55ec6ef98deab1160edc3276c3347cc101048e0fae5ab4ef589f6d8463b02d0d6ff85d92ab47c56418d0d8e1d72b1a4b686f83c5
SSDEEP 384:3E0WnRVhrGmNvpo6faDh9as5QPJp388Pt84kDGlzCTJEUmNY9bro3lcx2YDW:qhL+6i99uPJp3KatNXnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-54-0x0000000000180000-0x000000000018C000-memory.dmp

Download

memory/904-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download

memory/1688-62-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads