limerat | 551c6b570f45b33086e4428ca54dc9d9d199bdf1185fe48378ca155d1e7e9188

Analysis

max time kernel
36s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TunnelBear-Checker/bin/TunnelBear-connect.exe
Size

25KB
MD5

07f07820ea9ef64916f0e22ef06bfbff
SHA1

32257a2ff75af479d0e5f7c2f043f795bec058e4
SHA256

a60130cec8f6b0343eec84adf80a06eef791fb316fa803855eb1af520fe51aba
SHA512

25126bcfe0676a2d5208f092b09a7d29f028562eda9257df966caf8d04284f32aa17f83b5762558292aea79238c6cf3e1c4fafd612ccb14d7b8bad5afb87d04f
SSDEEP

384:SB+Sbj6NKQay6RpAHdizvih34EnWb5j4kDhlzCTJEUmNYEYQro3lcGIsjr:IpQN6RpwdiuaE+RHtN8/j

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
12213
antivm
true
c2_url
https://pastebin.com/raw/kRqKBgJj
delay
3
download_payload
false
install
true
install_name
Windows Defender.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
372	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

TunnelBear-connect.exe

description	pid	Process	procid_target
PID 2288 wrote to memory of 372	2288	TunnelBear-connect.exe	79
PID 2288 wrote to memory of 372	2288	TunnelBear-connect.exe	79
PID 2288 wrote to memory of 372	2288	TunnelBear-connect.exe	79

C:\Users\Admin\AppData\Local\Temp\TunnelBear-Checker\bin\TunnelBear-connect.exe
"C:\Users\Admin\AppData\Local\Temp\TunnelBear-Checker\bin\TunnelBear-connect.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-136-0x0000000000000000-mapping.dmp

Download
memory/2288-132-0x0000000000980000-0x000000000098C000-memory.dmp

Filesize
48KB

Download
memory/2288-133-0x00000000052C0000-0x000000000535C000-memory.dmp

Filesize
624KB

Download
memory/2288-134-0x0000000005360000-0x00000000053C6000-memory.dmp

Filesize
408KB

Download
memory/2288-135-0x00000000060D0000-0x0000000006674000-memory.dmp

Filesize
5.6MB

Download