limerat | 3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198

Analysis

max time kernel
172s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:30

Target

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe
Size

147KB
MD5

a33390dc8b84abe30014c46d0f9353cc
SHA1

efbd6b925d943a5973d508acafbe8d5e1a3a9818
SHA256

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198
SHA512

15f40830c7847475fe959553bd375c66a994369fb01bed0e983e0b0c8ebe710963b232331bbad90aa384e5e184a5df92711ad8c91edf1880672c7428890e6b81
SSDEEP

3072:I3QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZd:nTsx08PFYvS

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe

description	pid	Process	procid_target
PID 1068 set thread context of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid	Process
1184	dw20.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe

description	pid	Process	procid_target
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1068 wrote to memory of 1104	1068	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	28
PID 1104 wrote to memory of 1184	1104	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	29
PID 1104 wrote to memory of 1184	1104	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	29
PID 1104 wrote to memory of 1184	1104	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	29
PID 1104 wrote to memory of 1184	1104	3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198.exe	29

memory/1068-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1068-67-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-60-0x0000000000408D8E-mapping.dmp

Download
memory/1104-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-69-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-70-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1184-66-0x0000000000000000-mapping.dmp

Download