limerat | cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:30

Target

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe
Size

147KB
MD5

cff2d790319ab17e0a5c50cd472ff240
SHA1

e58cf042b5ad0f69adfbe75c9fb9964c74642cf4
SHA256

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a
SHA512

4d8023912869d6ac7ac3b88c452a79104bb0ce39c2284df0ba02439d3d7dba6b776a86354b0eeb44d721a8007d0fe2eb2bb4a8ee66b24b5b2d0110f4440f343c
SSDEEP

3072:73QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZq:8Tsx08PFYvS

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe

description	pid	Process	procid_target
PID 1472 set thread context of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.execad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe

description	pid	Process	procid_target
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 1472 wrote to memory of 856	1472	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	28
PID 856 wrote to memory of 1140	856	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	29
PID 856 wrote to memory of 1140	856	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	29
PID 856 wrote to memory of 1140	856	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	29
PID 856 wrote to memory of 1140	856	cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a.exe	29

memory/856-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-60-0x0000000000408D8E-mapping.dmp

Download
memory/856-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/856-68-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/856-70-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/1140-66-0x0000000000000000-mapping.dmp

Download
memory/1472-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1472-67-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download