limerat | fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

General

Target

fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe
Size

247KB
MD5

eb2bc869689c92c21e68f3e684ccea37
SHA1

54ed976bccb60e2ff754c94310a913c3063316a0
SHA256

fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c
SHA512

46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5
SSDEEP

3072:g/UfafnkXTXbYFxo5ob07ABrXSHMNQ/wCuGw0J0pokjMeltBitKdAZNAQq+8Vih:g/inXbYFxoz7ANEwnGw0iikivZNLqrY

Score

10^/10

limerat rat

Malware Config

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

.NET Reactor proctector 8 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2564-54-0x0000000000990000-0x00000000009D2000-memory.dmp	net_reactor
behavioral1/files/0x0004000000004ed7-67.dat	net_reactor
behavioral1/files/0x0004000000004ed7-65.dat	net_reactor
behavioral1/files/0x0004000000004ed7-63.dat	net_reactor
behavioral1/files/0x0004000000004ed7-61.dat	net_reactor
behavioral1/files/0x0004000000004ed7-68.dat	net_reactor
behavioral1/memory/2612-70-0x00000000012F0000-0x0000000001332000-memory.dmp	net_reactor
behavioral1/memory/2612-72-0x0000000004CE0000-0x0000000004D20000-memory.dmp	net_reactor

Executes dropped EXE 1 IoCs

pid	Process
2612	DiscordUppdataRas.exe

Loads dropped DLL 2 IoCs

pid	Process
2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe
2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2684	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	DiscordUppdataRas.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	DiscordUppdataRas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	DiscordUppdataRas.exe
Token: SeDebugPrivilege	2612	DiscordUppdataRas.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2684	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	31
PID 2564 wrote to memory of 2684	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	31
PID 2564 wrote to memory of 2684	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	31
PID 2564 wrote to memory of 2684	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	31
PID 2564 wrote to memory of 2612	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	33
PID 2564 wrote to memory of 2612	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	33
PID 2564 wrote to memory of 2612	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	33
PID 2564 wrote to memory of 2612	2564	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	33

C:\Users\Admin\AppData\Local\Temp\fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe
"C:\Users\Admin\AppData\Local\Temp\fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:2684
- C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe
  "C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
memory/2564-58-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2564-54-0x0000000000990000-0x00000000009D2000-memory.dmp

Filesize
264KB

Download
memory/2564-57-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2564-56-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2564-69-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2564-55-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2612-70-0x00000000012F0000-0x0000000001332000-memory.dmp

Filesize
264KB

Download
memory/2612-71-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2612-72-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2612-73-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2612-74-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads