limerat | 6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2022, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
Size 1.9MB
Sample220731-fxq47saae6
SHA256 6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a
MD5 6a1c606d5bcdde8e8c9d5c1cfe2cf39b
SHA1 1beea6604ade00fd2c06a8288d80dc69d7e2a23d
SHA512 29d98a7eae3459fe764ab1f18908b5fe34d1381f697596d892ad15858d494ce9a44a352d40ee534486004b73ef0c85413bae7facbca11ddc1516c185d3cea532
MD5 SHA1 SHA512

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
1205
antivm
false
c2_url
https://pastebin.com/raw/iRjhpqQL
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
4332	svhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gretryt.exe.lnk	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3188 set thread context of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4700	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\grtyty\gretryt.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
Token: 33	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
Token: SeIncBasePriorityPrivilege	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
Token: SeDebugPrivilege	4332	svhost.exe
Token: SeDebugPrivilege	4332	svhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3976	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	82
PID 3188 wrote to memory of 3976	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	82
PID 3188 wrote to memory of 3976	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	82
PID 3188 wrote to memory of 3172	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	84
PID 3188 wrote to memory of 3172	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	84
PID 3188 wrote to memory of 3172	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	84
PID 3188 wrote to memory of 4924	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	86
PID 3188 wrote to memory of 4924	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	86
PID 3188 wrote to memory of 4924	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	86
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4332	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	88
PID 3188 wrote to memory of 4420	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	89
PID 3188 wrote to memory of 4420	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	89
PID 3188 wrote to memory of 4420	3188	6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe	89
PID 4420 wrote to memory of 4700	4420	cmd.exe	91
PID 4420 wrote to memory of 4700	4420	cmd.exe	91
PID 4420 wrote to memory of 4700	4420	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe
"C:\Users\Admin\AppData\Local\Temp\6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a.exe" "%appdata%\grtyty\gretryt.exe" /Y
  2⤵
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\grtyty\gretryt.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\grtyty\gretryt.exe.jpg" gretryt.exe
  2⤵
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\grtyty\gretryt.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

gretryt.exe

Path C:\Users\Admin\AppData\Roaming\grtyty\gretryt.exe
Size 1.9MB
SHA256 6a4ca3dd3cdbf654692e4becf4b6672c4d07d6c9d732e7c92cfb3d9dbbc1318a
MD5 6a1c606d5bcdde8e8c9d5c1cfe2cf39b
SHA1 1beea6604ade00fd2c06a8288d80dc69d7e2a23d
SHA512 29d98a7eae3459fe764ab1f18908b5fe34d1381f697596d892ad15858d494ce9a44a352d40ee534486004b73ef0c85413bae7facbca11ddc1516c185d3cea532
SSDEEP 49152:i9FH2t+fsBA2vbcgKEQbjgzZ7dIUPuJeL:i9FHBcA21KtjgzjLPAeL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gretryt.exe.bat

Path C:\Users\Admin\AppData\Roaming\grtyty\gretryt.exe.bat
Size 203B
SHA256 0ebb0b091c1eabbe29d1c1dbd2f27fbe31c7a7fd88d7f17e7a9101471b321e4d
MD5 70256d774da9d180651d4610e183b114
SHA1 57ad9de3a8c571993e62c6055423c744b6b2dbe3
SHA512 058918f6f02a17fdd54e94be68c6b5ae9c29c2284fa36ab7609ba2d52cca67a627f30349fa47fd9872b7c4949c2670e8197e4ddb2a30b176447bb9e5b1fbd9c2
MD5 SHA1 SHA512

Submit Download

memory/3188-131-0x0000000008470000-0x0000000008A14000-memory.dmp

Download

memory/3188-132-0x0000000007F60000-0x0000000007FF2000-memory.dmp

Download

memory/3188-133-0x0000000008000000-0x000000000809C000-memory.dmp

Download

memory/3188-130-0x0000000000B30000-0x0000000000D18000-memory.dmp

Download

memory/4332-139-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4332-145-0x0000000005130000-0x0000000005196000-memory.dmp

Download