limerat | 641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8

General

Target

641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe
Size

760KB
MD5

9f700a5aa12ce068b6d7a78ab785b17a
SHA1

25742162d94f4479d557fb659e3a3280d91a1580
SHA256

641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8
SHA512

d6a4878db5e914dfbe763ae6e1ec9007e4c710bae89a78a714adc0efd05f772668ee4bee1ad1fcd4db61613f2438d0dfd529bf91b03af50c05e98f487f880938
SSDEEP

12288:kIAAhJZaF75GF2ibA6Sm/HO5J9MdpNNR36UH+4ahldt8VU2EfPrHLEgkMnJ6PM6:LAxb8AJovPR36UH+4C6u2E3Tzwr

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

1LLUV51XQKqq94X965Cc6uGPXeZEGSqCdV

Attributes

aes_key
NYANCAT
antivm
false
c2_url
https://pastebin.com/raw/4pByu6u5
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

Processes:

641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe

description	pid	Process	procid_target
PID 624 set thread context of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
520	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe

description	pid	Process
Token: SeDebugPrivilege	1168	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe
Token: SeDebugPrivilege	1168	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe

description	pid	Process	procid_target
PID 624 wrote to memory of 520	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	28
PID 624 wrote to memory of 520	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	28
PID 624 wrote to memory of 520	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	28
PID 624 wrote to memory of 520	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	28
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30
PID 624 wrote to memory of 1168	624	641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe	30

C:\Users\Admin\AppData\Local\Temp\641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe
"C:\Users\Admin\AppData\Local\Temp\641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KzSuNlCQoYKnH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE08.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:520
- C:\Users\Admin\AppData\Local\Temp\641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe
  "C:\Users\Admin\AppData\Local\Temp\641fe9f18ebb130d7a6b63ca7cc7fde7092e0a77447997009e5f23db698771e8.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEE08.tmp

Filesize
1KB

MD5
62bb725b54fa1164c1e4eb8ba23c5261

SHA1
d1925113da11e147b132fac40042eb1b5ab6febf

SHA256
773128b7602c1986948e662fe853d82b8fa61b7fbc0a7f73e13f91d7caa86687

SHA512
98a13c659cd7a2cc45e9cb27bf31ee753e19dd0a26fdf47684efe49ced7491a747ae2b76badca847422ccf9e74f1a37d513f32b09572a446c53b36b4a901303c

Download Submit
memory/624-54-0x0000000000D10000-0x0000000000DD2000-memory.dmp

Filesize
776KB

Download
memory/624-55-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/624-56-0x0000000000580000-0x0000000000596000-memory.dmp

Filesize
88KB

Download
memory/624-57-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/624-58-0x0000000005130000-0x00000000051B6000-memory.dmp

Filesize
536KB

Download
memory/624-59-0x0000000004BD0000-0x0000000004C1A000-memory.dmp

Filesize
296KB

Download
memory/1168-66-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-67-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1168-69-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-71-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-73-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1168-74-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/1168-75-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads