limerat | f1e57d1714f74c6939ee24bb348fa12e925ec7eb380d5a7d0f1d230effb742f4

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/04/2023, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

l1l1l.vbs
Size

129KB
MD5

c78f607c916f060d6ee3bf391e303acc
SHA1

1575998cda060d4a570ba258abc12044601da283
SHA256

f1e57d1714f74c6939ee24bb348fa12e925ec7eb380d5a7d0f1d230effb742f4
SHA512

cf26b8b381402622df420fa3881630661d08d76660d01be2d695af8ade568a6f5e3b365e4b17bffee5589d936eeaad3f7ebf413f4a2d810d976b66511548875b
SSDEEP

3072:OrDpGzBAtEbR1OsJlTtSjtH4UX9YWZiBh+exdMjd62dT:0

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty

Attributes

aes_key
nulled
antivm
true
c2_url
https://pastebin.com/raw/cXuQ0V20
delay
33
download_payload
false
install
false
install_name
dual.exe
main_folder
AppData
pin_spread
false
sub_folder
\DualCore\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1164	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KBnSgEeuZWeY.lnk	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1164	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1164	1604	WScript.exe	29
PID 1604 wrote to memory of 1164	1604	WScript.exe	29
PID 1604 wrote to memory of 1164	1604	WScript.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\l1l1l.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\tsQKDrCBEkat).evTHJP).'EntryPoint'.'Invoke'($Null,$Null)
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-60-0x0000000002270000-0x00000000022F0000-memory.dmp

Filesize
512KB

Download
memory/1164-61-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1164-62-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1164-63-0x0000000002580000-0x000000000258C000-memory.dmp

Filesize
48KB

Download
memory/1164-64-0x0000000002270000-0x00000000022F0000-memory.dmp

Filesize
512KB

Download
memory/1164-65-0x0000000002270000-0x00000000022F0000-memory.dmp

Filesize
512KB

Download