limerat | 241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

General

Target

0x0006000000022e29-172.exe
Size

28KB
MD5

3ed009fe337a7081b5d8b6ab558779ea
SHA1

0fab458919e434f2ee62d4513521bb795fa4a6a3
SHA256

241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd
SHA512

511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea
SSDEEP

384:3TB+Sbj6NKBOnN6syAHHk6xqD1s8+tFzYvDKNrCeJE3WNgMaFfXq8k05I7X7Qrol:Np8N6sywHUsHtFz245NbaxqLHXhj

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
082808
antivm
true
c2_url
https://pastebin.com/raw/Mh8T0LJe
delay
6
download_payload
false
install
true
install_name
limo.exe
main_folder
Temp
payload_url
https://mdl.arabou.edu.kw/ksa/user/profile/field/text/lang/en/VB64.exe
pin_spread
true
sub_folder
\Windows\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
1324	limo.exe

Loads dropped DLL 2 IoCs

pid	Process
1624	0x0006000000022e29-172.exe
1624	0x0006000000022e29-172.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2988	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	limo.exe
Token: SeDebugPrivilege	1324	limo.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2988	1624	0x0006000000022e29-172.exe	29
PID 1624 wrote to memory of 2988	1624	0x0006000000022e29-172.exe	29
PID 1624 wrote to memory of 2988	1624	0x0006000000022e29-172.exe	29
PID 1624 wrote to memory of 2988	1624	0x0006000000022e29-172.exe	29
PID 1624 wrote to memory of 1324	1624	0x0006000000022e29-172.exe	31
PID 1624 wrote to memory of 1324	1624	0x0006000000022e29-172.exe	31
PID 1624 wrote to memory of 1324	1624	0x0006000000022e29-172.exe	31
PID 1624 wrote to memory of 1324	1624	0x0006000000022e29-172.exe	31

C:\Users\Admin\AppData\Local\Temp\0x0006000000022e29-172.exe
"C:\Users\Admin\AppData\Local\Temp\0x0006000000022e29-172.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
memory/1324-13-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/1324-15-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/1324-16-0x0000000004720000-0x0000000004760000-memory.dmp

Filesize
256KB

Download
memory/1324-17-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/1324-18-0x0000000004720000-0x0000000004760000-memory.dmp

Filesize
256KB

Download
memory/1624-0-0x0000000000D90000-0x0000000000D9C000-memory.dmp

Filesize
48KB

Download
memory/1624-3-0x0000000000A20000-0x0000000000A60000-memory.dmp

Filesize
256KB

Download
memory/1624-1-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-14-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads