limerat | a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf

Analysis

max time kernel
135s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:30

Target

a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe
Size

209KB
MD5

8f2b5ea332e3ccce22b109de0cfe4fd7
SHA1

8938199f8346c6a27a106bfae658017613d7f935
SHA256

a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf
SHA512

f1b04d1c264255deedc5f627b13279589b7ac06685ebfd1c90f670b8bbda450a1faab796fc3226180c790c0891eab0e286d2c533bfd252ed795b63e3086a0383
SSDEEP

3072:v2gawntv0gTmsqBSNAVk2ThBmbIenFqeWnKpAAKg6HvF:uFsvFCsqoNI/+FunKpAA6

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe

description	pid	Process	procid_target
PID 972 set thread context of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid	Process
592	dw20.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exea14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe

description	pid	Process	procid_target
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 972 wrote to memory of 1172	972	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	28
PID 1172 wrote to memory of 592	1172	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	29
PID 1172 wrote to memory of 592	1172	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	29
PID 1172 wrote to memory of 592	1172	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	29
PID 1172 wrote to memory of 592	1172	a14a7db2cd820a22051c2fc7e7fde1742a3a229629def61199fd35eec1807edf.exe	29

memory/592-66-0x0000000000000000-mapping.dmp

Download
memory/972-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/972-67-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-60-0x0000000000408D8E-mapping.dmp

Download
memory/1172-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1172-69-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-70-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download