limerat | e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9

General

Target
e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe
Size 1.2MB
Sample220701-fpqtgaehd9
SHA256 e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9
MD5 d1b9aab2bd88b4cf9808d7e5dad0e204
SHA1 0d2a2722c5177dfd580c755a8459a79842484f7b
SHA512 a5f38eaf93852a1b8382ed884189d564c13077520ee1855a96d617e363f85d5e179b928b9c55c00d93ac42fd1f0d0aa91c216a2fd7ad6e7c93fca1583110c1df
MD5 SHA1 SHA512

Score

10^/10

Family

Wallets

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asvyAIjjwP = "C:\\Users\\Public\\asvyAIjjwP.vbs"	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3560 set thread context of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4296	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	RegAsm.exe
Token: SeDebugPrivilege	4552	RegAsm.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of SendNotifyMessage 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82
PID 3560 wrote to memory of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82
PID 3560 wrote to memory of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82
PID 3560 wrote to memory of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82
PID 3560 wrote to memory of 4552	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	82
PID 3560 wrote to memory of 5004	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	91
PID 3560 wrote to memory of 5004	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	91
PID 3560 wrote to memory of 5004	3560	e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe	91
PID 5004 wrote to memory of 4296	5004	cmd.exe	93
PID 5004 wrote to memory of 4296	5004	cmd.exe	93
PID 5004 wrote to memory of 4296	5004	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe
"C:\Users\Admin\AppData\Local\Temp\e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\e89502dbd34503e7c39c58bb3fd0c4716e8298f703298e099f9199e3e44712d9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\timeout.exe
    TimeOut 1
    3⤵
    - Delays execution with timeout.exe
    PID:4296