limerat | 7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2022, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
Size 2.4MB
Sample220731-kst3hsaabl
SHA256 7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e
MD5 d62772aab4ce2a4301fb122de9155e61
SHA1 aaa45a516e7fa85e472a97dc4d6d1dda092850f6
SHA512 7cd9ed6071030faa0a26194177349c97a9f06bedb3ffb59a2f999127bf4f7c1e68c8a3ec4b19bf25aedccecdfea9ccc4956009d43738fb3ee963615285fd9b91
MD5 SHA1 SHA512

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
1205
antivm
false
c2_url
https://pastebin.com/raw/iRjhpqQL
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
360	svhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rtgrtr.exe.lnk	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4156 set thread context of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3628	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\dfghrt\rtgrtr.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
Token: 33	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
Token: SeIncBasePriorityPrivilege	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
Token: SeDebugPrivilege	360	svhost.exe
Token: SeDebugPrivilege	360	svhost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4560	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	83
PID 4156 wrote to memory of 4560	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	83
PID 4156 wrote to memory of 4560	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	83
PID 4156 wrote to memory of 2100	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	85
PID 4156 wrote to memory of 2100	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	85
PID 4156 wrote to memory of 2100	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	85
PID 4156 wrote to memory of 3484	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	87
PID 4156 wrote to memory of 3484	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	87
PID 4156 wrote to memory of 3484	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	87
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 360	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	89
PID 4156 wrote to memory of 628	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	90
PID 4156 wrote to memory of 628	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	90
PID 4156 wrote to memory of 628	4156	7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe	90
PID 628 wrote to memory of 3628	628	cmd.exe	92
PID 628 wrote to memory of 3628	628	cmd.exe	92
PID 628 wrote to memory of 3628	628	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe
"C:\Users\Admin\AppData\Local\Temp\7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e.exe" "%appdata%\dfghrt\rtgrtr.exe" /Y
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\dfghrt\rtgrtr.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\dfghrt\rtgrtr.exe.jpg" rtgrtr.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\dfghrt\rtgrtr.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtgrtr.exe

Path C:\Users\Admin\AppData\Roaming\dfghrt\rtgrtr.exe
Size 2.4MB
SHA256 7965609f1fe078275c2f8316d3fff1d25393e096f9abd1952928a53fc2ea2c9e
MD5 d62772aab4ce2a4301fb122de9155e61
SHA1 aaa45a516e7fa85e472a97dc4d6d1dda092850f6
SHA512 7cd9ed6071030faa0a26194177349c97a9f06bedb3ffb59a2f999127bf4f7c1e68c8a3ec4b19bf25aedccecdfea9ccc4956009d43738fb3ee963615285fd9b91
SSDEEP 49152:e4c0EaMXWar66I9Etn8ko2KqVP7+uuJeLG:exIMGFsn8koUKuAeLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtgrtr.exe.bat

Path C:\Users\Admin\AppData\Roaming\dfghrt\rtgrtr.exe.bat
Size 202B
SHA256 8c7ca9f13283668aacd56f9800fec47f51e2dae0d598a0d9ad26cbc922a08dbf
MD5 e92035db20732f5bc96832cfb247db32
SHA1 04c38568327469bc0ac173987ff9d8454bb0cdab
SHA512 bb2ce691e14e51ae3a2b012ae936fb9f9ddf62ae7ea88c217351d82b2dc3064e3334838baa83a939bd3eddb9257078683e685d4d6a99a0896914d6d6ce7d635a
MD5 SHA1 SHA512

Submit Download

memory/360-145-0x0000000005240000-0x00000000052A6000-memory.dmp

Download

memory/360-139-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4156-133-0x0000000005280000-0x000000000531C000-memory.dmp

Download

memory/4156-130-0x0000000000380000-0x00000000005EA000-memory.dmp

Download

memory/4156-132-0x0000000005130000-0x00000000051C2000-memory.dmp

Download

memory/4156-131-0x0000000005830000-0x0000000005DD4000-memory.dmp

Download