Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
09-07-2023 08:17
General
-
Target
NewClientexeexeexeexeexee.exe
-
Size
25KB
-
MD5
4347e22b925cb84a77f9efbcd93127b8
-
SHA1
dd2795bf3fe8d5de291fb136e56101fd79433f2d
-
SHA256
988b8a7e213e9f51aaa6b224d358980d069b0ea40e86dd7dd53fbacaef38cbac
-
SHA512
d01371a3b6b81ed57527e5e689c6a3a83ec9bb515abdee94b3ea3a9bd6fe138da8f0cbaa34c7ff3724d4e57f477579842d15fd6e49e30d743cdc9cde32b20146
-
SSDEEP
384:9B+Sbj6NK8R+6VFAHdkaIh34EnWb5j4kDhlzCTJEUmNYEYQro3lcvC8sjr:Xp8E6VFwdqaE+RHtN8Dj
Score
10/10
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
shouldvelistened
-
antivm
false
-
c2_url
https://pastebin.com/raw/X4egnDWF
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
UserProfile
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewClientexeexeexeexeexee.exe"C:\Users\Admin\AppData\Local\Temp\NewClientexeexeexeexeexee.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
256KB