limerat | fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

General

Target

fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe
Size

247KB
MD5

eb2bc869689c92c21e68f3e684ccea37
SHA1

54ed976bccb60e2ff754c94310a913c3063316a0
SHA256

fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c
SHA512

46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5
SSDEEP

3072:g/UfafnkXTXbYFxo5ob07ABrXSHMNQ/wCuGw0J0pokjMeltBitKdAZNAQq+8Vih:g/inXbYFxoz7ANEwnGw0iikivZNLqrY

Score

10^/10

limerat rat

Malware Config

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4812-133-0x0000000000350000-0x0000000000392000-memory.dmp	net_reactor
behavioral2/files/0x00060000000231f1-145.dat	net_reactor
behavioral2/files/0x00060000000231f1-147.dat	net_reactor
behavioral2/files/0x00060000000231f1-148.dat	net_reactor

Executes dropped EXE 1 IoCs

pid	Process
5056	DiscordUppdataRas.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4412	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	DiscordUppdataRas.exe
Token: SeDebugPrivilege	5056	DiscordUppdataRas.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4412	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	90
PID 4812 wrote to memory of 4412	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	90
PID 4812 wrote to memory of 4412	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	90
PID 4812 wrote to memory of 5056	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	92
PID 4812 wrote to memory of 5056	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	92
PID 4812 wrote to memory of 5056	4812	fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe	92

C:\Users\Admin\AppData\Local\Temp\fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe
"C:\Users\Admin\AppData\Local\Temp\fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:4412
- C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe
  "C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
C:\Users\Admin\AppData\Roaming\DiscordUppdataRas.exe

Filesize
247KB

MD5
eb2bc869689c92c21e68f3e684ccea37

SHA1
54ed976bccb60e2ff754c94310a913c3063316a0

SHA256
fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c

SHA512
46d322eefc0eee6555d08a0cb0cdf2e6b1a3400bdc447499484cdd2800c569c73b95e0759f6984c7af38dbb9ba5a8d4ddb5796cd8cc9b0d9bf86f39f16db58a5

Download Submit
memory/4812-137-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4812-133-0x0000000000350000-0x0000000000392000-memory.dmp

Filesize
264KB

Download
memory/4812-138-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4812-139-0x00000000050E0000-0x0000000005146000-memory.dmp

Filesize
408KB

Download
memory/4812-140-0x0000000005A40000-0x0000000005FE4000-memory.dmp

Filesize
5.6MB

Download
memory/4812-136-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Filesize
624KB

Download
memory/4812-135-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4812-134-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4812-150-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/5056-151-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/5056-152-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/5056-153-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/5056-154-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads