limerat | 1244-58-0x0000000000400000-0x000000000040C000-memory[.]dmp

General

Target
1244-58-0x0000000000400000-0x000000000040C000-memory.dmp
Size 48KB
Sample220608-wfg3zaece3
SHA256 a5a95da2cc6c1c045b9162c62e79f215f5dc718026f4490059840e126f957879
MD5 ed59df8b328f9a46bc00f704954688e9
SHA1 d8512991bac00913dc3087a3762dd5df5d478c22
SHA512 d3a43a4e0f64188c529980e727a8ce0bac28aaa0c7ca66d0f9c8af26b5635f60deb220379e67aa1c293ada17327a7fd14f4a29c0c7f3a7f2a65eae8ea70f6db4
SSDEEP 384:0E0WnRVKAfmnJpoofaPhZil8w8S1nnr09lcaLD2+vDANrCeJEmWNUtLzWOaGTT+D:BKDEoi5Z9wZr0pWINXOaG83UsY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

limerat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Admin
antivm
false
c2_url
https://pastebin.com/raw/FkvEmWML
delay
3
download_payload
false
install
true
install_name
svhost.exe
main_folder
UserProfile
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

Limerat family
limerat

File Explorer

1244-58-0x0000000000400000-0x000000000040C000-memory.dmp

.exe 48KB

1244-58-0x0000000000400000-0x000000000040C000-memory.dmp

SHA256 a5a95da2cc6c1c045b9162c62e79f215f5dc718026f4490059840e126f957879
MD5 ed59df8b328f9a46bc00f704954688e9
SHA1 d8512991bac00913dc3087a3762dd5df5d478c22
SHA512 d3a43a4e0f64188c529980e727a8ce0bac28aaa0c7ca66d0f9c8af26b5635f60deb220379e67aa1c293ada17327a7fd14f4a29c0c7f3a7f2a65eae8ea70f6db4
SSDEEP 384:0E0WnRVKAfmnJpoofaPhZil8w8S1nnr09lcaLD2+vDANrCeJEmWNUtLzWOaGTT+D:BKDEoi5Z9wZr0pWINXOaG83UsY
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

35150

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing