limerat | 1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:30

Target

1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe
Size

51KB
MD5

6707ad66e20d361e5b99addbd276a5de
SHA1

98973242d2b7c2cff5471f512154abfb90b3f242
SHA256

1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c
SHA512

a3c68349ff9969b83b00fa9e571dccd42af79092fd4f1d6a8120df11a787ac0ce140f78290de73443ed68a4cde41576b72b62faaac1a31f527f2f24cf819fae3
SSDEEP

768:ivAVecSXuXkkZwLnuivpcWKV4M3AT154QawGhmJmtTqPBWypMSFgLALQKTU:iv5cgawn3XKV1E54Qa0iUBbFgqbw

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe

description	pid	Process	procid_target
PID 288 set thread context of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe

description	pid	Process	procid_target
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 288 wrote to memory of 1176	288	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	26
PID 1176 wrote to memory of 856	1176	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	27
PID 1176 wrote to memory of 856	1176	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	27
PID 1176 wrote to memory of 856	1176	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	27
PID 1176 wrote to memory of 856	1176	1c0a20b9f16454d81b193721bb78ade2c70ccd503e76d9cdad7db7568064585c.exe	27

memory/288-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/288-66-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/856-67-0x0000000000000000-mapping.dmp

Download
memory/1176-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-60-0x0000000000408D8E-mapping.dmp

Download
memory/1176-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1176-69-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1176-70-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download