limerat | 790ab1b252798c464c4b472d45fbb8063e0f29008ba7273b515c14597dbfa17a

Analysis

max time kernel
227s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Parcel receipt.scr
Size 928KB
Sample220520-p6hnvsfeem
SHA256 7e1aedab87d6c23e82dd24f2a1975da18d252d5646365a5776a7f3089268c946
MD5 cce93b0317a848c601a12f2a3c3cd14f
SHA1 7f3bb0b8c36cbab52de216b69fe1ede97b1f6899
SHA512 f2977f53388a3145fc734cc6747b58a73a879247a6ab14495d96cea7b45531579bde773f5e6f0ed76dcac68903b9467d287421045f9cf507e4be332aa1d1aa78
MD5 SHA1 SHA512

Score

10^/10

limerat evasion persistence rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
123456789
antivm
false
c2_url
https://pastebin.com/raw/5cXHFyui
delay
3
download_payload
false
install
true
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
4884	thaepnern.pif
3336	Wservices.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Parcel receipt.scr
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	thaepnern.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	thaepnern.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\43486004\\THAEPN~1.PIF C:\\Users\\Admin\\AppData\\Roaming\\43486004\\jvganwua.cvm"	thaepnern.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 3196	4884	thaepnern.pif	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
4884	thaepnern.pif
3196	RegSvcs.exe
3196	RegSvcs.exe
3196	RegSvcs.exe
3196	RegSvcs.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4884	4928	Parcel receipt.scr	79
PID 4928 wrote to memory of 4884	4928	Parcel receipt.scr	79
PID 4928 wrote to memory of 4884	4928	Parcel receipt.scr	79
PID 4884 wrote to memory of 3476	4884	thaepnern.pif	81
PID 4884 wrote to memory of 3476	4884	thaepnern.pif	81
PID 4884 wrote to memory of 3476	4884	thaepnern.pif	81
PID 4884 wrote to memory of 2764	4884	thaepnern.pif	82
PID 4884 wrote to memory of 2764	4884	thaepnern.pif	82
PID 4884 wrote to memory of 2764	4884	thaepnern.pif	82
PID 4884 wrote to memory of 5096	4884	thaepnern.pif	83
PID 4884 wrote to memory of 5096	4884	thaepnern.pif	83
PID 4884 wrote to memory of 5096	4884	thaepnern.pif	83
PID 4884 wrote to memory of 1432	4884	thaepnern.pif	84
PID 4884 wrote to memory of 1432	4884	thaepnern.pif	84
PID 4884 wrote to memory of 1432	4884	thaepnern.pif	84
PID 4884 wrote to memory of 212	4884	thaepnern.pif	85
PID 4884 wrote to memory of 212	4884	thaepnern.pif	85
PID 4884 wrote to memory of 212	4884	thaepnern.pif	85
PID 4884 wrote to memory of 1688	4884	thaepnern.pif	86
PID 4884 wrote to memory of 1688	4884	thaepnern.pif	86
PID 4884 wrote to memory of 1688	4884	thaepnern.pif	86
PID 4884 wrote to memory of 3212	4884	thaepnern.pif	87
PID 4884 wrote to memory of 3212	4884	thaepnern.pif	87
PID 4884 wrote to memory of 3212	4884	thaepnern.pif	87
PID 4884 wrote to memory of 3196	4884	thaepnern.pif	88
PID 4884 wrote to memory of 3196	4884	thaepnern.pif	88
PID 4884 wrote to memory of 3196	4884	thaepnern.pif	88
PID 4884 wrote to memory of 3196	4884	thaepnern.pif	88
PID 4884 wrote to memory of 3196	4884	thaepnern.pif	88
PID 3196 wrote to memory of 4956	3196	RegSvcs.exe	90
PID 3196 wrote to memory of 4956	3196	RegSvcs.exe	90
PID 3196 wrote to memory of 4956	3196	RegSvcs.exe	90
PID 3196 wrote to memory of 3336	3196	RegSvcs.exe	92
PID 3196 wrote to memory of 3336	3196	RegSvcs.exe	92
PID 3196 wrote to memory of 3336	3196	RegSvcs.exe	92

C:\Users\Admin\AppData\Local\Temp\Parcel receipt.scr
"C:\Users\Admin\AppData\Local\Temp\Parcel receipt.scr" /S
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Roaming\43486004\thaepnern.pif
  "C:\Users\Admin\AppData\Roaming\43486004\thaepnern.pif" jvganwua.cvm
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:212
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:3212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Wservices.exe'"
      4⤵
      Creates scheduled task(s)
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Wservices.exe
      "C:\Users\Admin\AppData\Local\Temp\Wservices.exe"
      4⤵
      Executes dropped EXE
      PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wservices.exe

Path C:\Users\Admin\AppData\Local\Temp\Wservices.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wservices.exe

Path C:\Users\Admin\AppData\Local\Temp\Wservices.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvganwua.cvm

Path C:\Users\Admin\AppData\Roaming\43486004\jvganwua.cvm
Size 223.7MB
SHA256 a06190f5bf841a6f100f32fe41f45e97e54213556683ce7d2ff2b034cd0e3b5d
MD5 fcdc76f4918415581833f1bcfbf8eb9a
SHA1 9b958e2999256a447684c34d2ca0aac61e703bf0
SHA512 4be535f2bb52bdca823ed40d2f44345e2e48dfd62793d70025b604c516f8de1edc2abf9111e501cf9c9dc60077d33717e1cae8e45163396d9ee2346176d84eef
SSDEEP 98304:+GPG7GzGUGSGoGXGnGYGfGXGRGoG4GKGsGwGbGKG+GBG1GEG8G9GJGaG3G2G/GYH:j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssvklbb.ppt

Path C:\Users\Admin\AppData\Roaming\43486004\ssvklbb.ppt
Size 124KB
SHA256 d2bff3004f8f7e2f4718f15d2f403af932177dd18100e77645233bdbca2ef4fa
MD5 85be0fce2d73ebf5319916013d3cc913
SHA1 7a874685bf4619cfb0d6419587e6f27988710b61
SHA512 01b0268405bebd3d00b35302cec7092c97aa8ce9af1aa9ca291cf7281bc45ad234185a6f2f2ef3e87decf2d9e53fbfe33fe40daa271a8e7eea41eec5c005217f
SSDEEP 3072:xh1puOSsCpGbhF0KOS2ktLrITGcbyCpAAmOwBV:x7pvS3pGbAKN1LrIhFtIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaepnern.pif

Path C:\Users\Admin\AppData\Roaming\43486004\thaepnern.pif
Size 646KB
SHA256 59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
MD5 d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1 d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA512 70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
SSDEEP 12288:YBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aYJ5DGDt2:icneJVBvXAvwRJdwvZ5aYJ5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaepnern.pif

Path C:\Users\Admin\AppData\Roaming\43486004\thaepnern.pif
Size 646KB
SHA256 59e9d4edac6322ecfa53762dfaa541b2e6d7c3b0b9c6885fd7e0c3e18a38e14d
MD5 d3ffbde7ea1bcb2d0a6e6e12b0306625
SHA1 d8725bc8fdd1d5a5e7b9615dcd424bc9aa7322ff
SHA512 70660fa375400b08610544b323dc7eb0f8258eda57822d1554f0811447a8e5fa0911e451a9a247a85a661cd5f7de8d6805e79617e62d5234bdf78e08b76b254a
SSDEEP 12288:YBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aYJ5DGDt2:icneJVBvXAvwRJdwvZ5aYJ5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3196-142-0x0000000001100000-0x00000000016A8000-memory.dmp

Download

memory/3196-147-0x0000000006A50000-0x0000000006FF4000-memory.dmp

Download

memory/3196-146-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/3196-144-0x0000000001100000-0x000000000110C000-memory.dmp

Download

memory/3196-145-0x0000000005E50000-0x0000000005EEC000-memory.dmp

Download

memory/3336-153-0x00000000053D0000-0x000000000540C000-memory.dmp

Download

memory/3336-152-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Download