limerat | 228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4

General

Target

228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe
Size

29KB
MD5

4867caf94a1222a561e9b443a4e01ee6
SHA1

7903ad13a5ba397ff5d79191a089804b003699ff
SHA256

228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4
SHA512

7016835d4044a7ce2e7b4019ed185a1f47b3c1e43ca48cc821c7d9e0c9b1cee8a8f80125eb6246e16310348297a864d31e2dcefbdfae944d4976a03f3d5f910c
SSDEEP

768:IqptXM6N2wHiBN0HY45NPhRXKV1TdPKEj:IqpF2wH4IlnmgE

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

31u93LeqAjhmu48kA6JYNVSyGshBNvnqNS

Attributes

aes_key
%D*G-KaN
antivm
false
c2_url
https://pastebin.com/raw/3YAbmSCc
delay
6
download_payload
false
install
true
install_name
AudioDriver.exe
main_folder
UserProfile
pin_spread
true
sub_folder
\Windows\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
1492	AudioDriver.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe
1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1816	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	AudioDriver.exe
Token: SeDebugPrivilege	1492	AudioDriver.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1816	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	28
PID 1672 wrote to memory of 1816	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	28
PID 1672 wrote to memory of 1816	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	28
PID 1672 wrote to memory of 1816	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	28
PID 1672 wrote to memory of 1492	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	30
PID 1672 wrote to memory of 1492	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	30
PID 1672 wrote to memory of 1492	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	30
PID 1672 wrote to memory of 1492	1672	228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe	30

C:\Users\Admin\AppData\Local\Temp\228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe
"C:\Users\Admin\AppData\Local\Temp\228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Windows\AudioDriver.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:1816
- C:\Users\Admin\Windows\AudioDriver.exe
  "C:\Users\Admin\Windows\AudioDriver.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Windows\AudioDriver.exe

Filesize
29KB

MD5
4867caf94a1222a561e9b443a4e01ee6

SHA1
7903ad13a5ba397ff5d79191a089804b003699ff

SHA256
228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4

SHA512
7016835d4044a7ce2e7b4019ed185a1f47b3c1e43ca48cc821c7d9e0c9b1cee8a8f80125eb6246e16310348297a864d31e2dcefbdfae944d4976a03f3d5f910c

Download Submit
C:\Users\Admin\Windows\AudioDriver.exe

Filesize
29KB

MD5
4867caf94a1222a561e9b443a4e01ee6

SHA1
7903ad13a5ba397ff5d79191a089804b003699ff

SHA256
228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4

SHA512
7016835d4044a7ce2e7b4019ed185a1f47b3c1e43ca48cc821c7d9e0c9b1cee8a8f80125eb6246e16310348297a864d31e2dcefbdfae944d4976a03f3d5f910c

Download Submit
\Users\Admin\Windows\AudioDriver.exe

Filesize
29KB

MD5
4867caf94a1222a561e9b443a4e01ee6

SHA1
7903ad13a5ba397ff5d79191a089804b003699ff

SHA256
228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4

SHA512
7016835d4044a7ce2e7b4019ed185a1f47b3c1e43ca48cc821c7d9e0c9b1cee8a8f80125eb6246e16310348297a864d31e2dcefbdfae944d4976a03f3d5f910c

Download Submit
\Users\Admin\Windows\AudioDriver.exe

Filesize
29KB

MD5
4867caf94a1222a561e9b443a4e01ee6

SHA1
7903ad13a5ba397ff5d79191a089804b003699ff

SHA256
228d45f589db33d9f9afb5fe00f1c0dca51227c1b255d34fe3b9068ce82a47d4

SHA512
7016835d4044a7ce2e7b4019ed185a1f47b3c1e43ca48cc821c7d9e0c9b1cee8a8f80125eb6246e16310348297a864d31e2dcefbdfae944d4976a03f3d5f910c

Download Submit
memory/1492-62-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/1672-54-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

Filesize
48KB

Download
memory/1672-56-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads