limerat | bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3

Analysis

max time kernel
310s
max time network
405s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:05

Target

bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe
Size

238KB
MD5

440d7a7357b48507cbf9857064638dfd
SHA1

fbf4d41cc343cb260d0c320ade3c1271959d6eba
SHA256

bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3
SHA512

ee709aa46f4506aa1ce26d0edcdbf9241749ed154e1a8ab2976b691f95469c8cdef168d59ad27773506e433debb0a28550f113f6bb5b7e1e12c994fcd2aa875c
SSDEEP

3072:zTZ5rlD8r5Yg3g7xnyfKUze1zF9Olhc7tmtpsJpQuTejgu3nypr/7Rioqz5HKd/z:zTyYg3AnySQcWlqi1ERio6q2U

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81
PID 2312 wrote to memory of 4480	2312	bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe	81

C:\Users\Admin\AppData\Local\Temp\bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe
"C:\Users\Admin\AppData\Local\Temp\bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe
  "C:\Users\Admin\AppData\Local\Temp\bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe"
  2⤵
  PID:4480

memory/2312-132-0x0000000000500000-0x0000000000542000-memory.dmp

Filesize
264KB

Download
memory/4480-134-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4480-135-0x0000000005370000-0x000000000540C000-memory.dmp

Filesize
624KB

Download
memory/4480-136-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download