limerat | 865f0c77242db6c8bc7853d56c80df25d0131978cc693fc2a05a392316cfc566

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromiumUpdateexeexeexeex.exe
Size

44KB
MD5

fda53976d89ab903557b9528cc2fb91d
SHA1

c42781c8328b1dbb70c3571fcadd9f674c5df333
SHA256

865f0c77242db6c8bc7853d56c80df25d0131978cc693fc2a05a392316cfc566
SHA512

7b7f0efd96a67026aea1661fee86358557b89d67ed8c96c9125a61958570e00e9cab2cc84950cdd8eb799cdc8e5f2cdc0d1c90da2b0c891920b700c203e44444
SSDEEP

768:TpYT6H3wjsG/YS445NoDamKOAZB6in1WjctC1iTIPYe:TpH3wj9/ZF8DHoBGgCuIP7

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

bc1qwycfayk08cnnj2ng0emn8yeek6hkdkdvue952a

Attributes

aes_key
vELKIjFPTOEs91pZ1LF+7gl6DaQq5z3kH6Q5FyFhRO8/6K8Xpl7YLTgTqwUttOW5
antivm
false
c2_url
https://pastebin.com/raw/DDTVwwbu
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
true
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ChromiumUpdateexeexeexeex.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	ChromiumUpdateexeexeexeex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	ChromiumUpdateexeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ChromiumUpdateexeexeexeex.exe

description pid process

Token: SeDebugPrivilege 2400 ChromiumUpdateexeexeexeex.exe
Token: SeDebugPrivilege 2400 ChromiumUpdateexeexeexeex.exe

description	pid	process
Token: SeDebugPrivilege	2400	ChromiumUpdateexeexeexeex.exe
Token: SeDebugPrivilege	2400	ChromiumUpdateexeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\ChromiumUpdateexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ChromiumUpdateexeexeexeex.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-54-0x00000000009A0000-0x00000000009B0000-memory.dmp

Filesize
64KB

Download
memory/2400-55-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2400-56-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download