limerat | 241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x0006000000022e29-172.exe
Size

28KB
MD5

3ed009fe337a7081b5d8b6ab558779ea
SHA1

0fab458919e434f2ee62d4513521bb795fa4a6a3
SHA256

241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd
SHA512

511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea
SSDEEP

384:3TB+Sbj6NKBOnN6syAHHk6xqD1s8+tFzYvDKNrCeJE3WNgMaFfXq8k05I7X7Qrol:Np8N6sywHUsHtFz245NbaxqLHXhj

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
082808
antivm
true
c2_url
https://pastebin.com/raw/Mh8T0LJe
delay
6
download_payload
false
install
true
install_name
limo.exe
main_folder
Temp
payload_url
https://mdl.arabou.edu.kw/ksa/user/profile/field/text/lang/en/VB64.exe
pin_spread
true
sub_folder
\Windows\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
4736	limo.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3236	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	limo.exe
Token: SeDebugPrivilege	4736	limo.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3236	2316	0x0006000000022e29-172.exe	87
PID 2316 wrote to memory of 3236	2316	0x0006000000022e29-172.exe	87
PID 2316 wrote to memory of 3236	2316	0x0006000000022e29-172.exe	87
PID 2316 wrote to memory of 4736	2316	0x0006000000022e29-172.exe	91
PID 2316 wrote to memory of 4736	2316	0x0006000000022e29-172.exe	91
PID 2316 wrote to memory of 4736	2316	0x0006000000022e29-172.exe	91

C:\Users\Admin\AppData\Local\Temp\0x0006000000022e29-172.exe
"C:\Users\Admin\AppData\Local\Temp\0x0006000000022e29-172.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\limo.exe

Filesize
28KB

MD5
3ed009fe337a7081b5d8b6ab558779ea

SHA1
0fab458919e434f2ee62d4513521bb795fa4a6a3

SHA256
241612ebc1cb84fa0f2bd663718f35ca9e07f2ff2640ffe113afe3cecb9bd2bd

SHA512
511cb5dabca9ace7c369e77510428a7144824a53894af42cba04ada12884228a14747f1b4e87ed6aa10d0101ee90567c3c873fd33c8450f8ccc3892b4cf669ea

Download Submit
memory/2316-3-0x0000000004FB0000-0x0000000005016000-memory.dmp

Filesize
408KB

Download
memory/2316-4-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/2316-5-0x0000000005B50000-0x00000000060F4000-memory.dmp

Filesize
5.6MB

Download
memory/2316-7-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2316-0-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2316-2-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Filesize
624KB

Download
memory/2316-1-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2316-17-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4736-16-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4736-18-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/4736-19-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4736-20-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads