limerat | 52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f

Analysis

max time kernel
147s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2023 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e737644c21402034c863a89de9f785.exe
Size

33KB
MD5

54e737644c21402034c863a89de9f785
SHA1

fa4aa0237c56c2f787d5eea774d03e0fd30d8405
SHA256

52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
SHA512

a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a
SSDEEP

768:dpHG6XbwtuEEP545NXc3g7lwYmemFjRu:dpXbwtvwuzQg7KYBYN

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Yp3s6v9y$B?E(H+M
antivm
false
c2_url
https://pastebin.com/raw/hkXuRtp9
delay
3
download_payload
false
install
true
install_name
OverTheCounter.exe
main_folder
Temp
pin_spread
false
sub_folder
\otc\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
612	OverTheCounter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	54e737644c21402034c863a89de9f785.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe
612	OverTheCounter.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	OverTheCounter.exe
Token: SeDebugPrivilege	612	OverTheCounter.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3028	720	54e737644c21402034c863a89de9f785.exe	84
PID 720 wrote to memory of 3028	720	54e737644c21402034c863a89de9f785.exe	84
PID 720 wrote to memory of 3028	720	54e737644c21402034c863a89de9f785.exe	84
PID 720 wrote to memory of 612	720	54e737644c21402034c863a89de9f785.exe	86
PID 720 wrote to memory of 612	720	54e737644c21402034c863a89de9f785.exe	86
PID 720 wrote to memory of 612	720	54e737644c21402034c863a89de9f785.exe	86

C:\Users\Admin\AppData\Local\Temp\54e737644c21402034c863a89de9f785.exe
"C:\Users\Admin\AppData\Local\Temp\54e737644c21402034c863a89de9f785.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\otc\OverTheCounter.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\otc\OverTheCounter.exe
  "C:\Users\Admin\AppData\Local\Temp\otc\OverTheCounter.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\otc\OverTheCounter.exe

Filesize
33KB

MD5
54e737644c21402034c863a89de9f785

SHA1
fa4aa0237c56c2f787d5eea774d03e0fd30d8405

SHA256
52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f

SHA512
a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\otc\OverTheCounter.exe

Filesize
33KB

MD5
54e737644c21402034c863a89de9f785

SHA1
fa4aa0237c56c2f787d5eea774d03e0fd30d8405

SHA256
52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f

SHA512
a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a

Download Submit
memory/612-140-0x0000000007210000-0x00000000072A2000-memory.dmp

Filesize
584KB

Download
memory/720-132-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/720-133-0x0000000004FD0000-0x000000000506C000-memory.dmp

Filesize
624KB

Download
memory/720-134-0x0000000004F00000-0x0000000004F66000-memory.dmp

Filesize
408KB

Download
memory/720-135-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download