Overview

overview

10

Static

static

10

New-Client.exe

windows7-x64

10

New-Client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2023 11:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New-Client.exe

  • Size

    28KB

  • MD5

    d898b717f2129c07bbe04ff2a2bb7bb4

  • SHA1

    95d3d764eb040fc2bc942ce0b76d79dddf22cc7b

  • SHA256

    85e96053fbc095636e06efbb30a691a50b55035f8058f4ea1d0ccd95622b3937

  • SHA512

    9fef06885c7695c601074612c97b6555065f5810c6d36897e0a6775cb4d06164e77d7121d46328c2549226ffa4a40ca8bd1c82d6b21868157db291471124bb17

  • SSDEEP

    768:Mp2S6JBwNOXO27n745Nn7HmXVgvjggmDYj:Mp8BwNwnnkr72Asgm8

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    149.19.230.52

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/DDTVwwbu

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/DDTVwwbu

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New-Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New-Client.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2776-0-0x00000000009D0000-0x00000000009DC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2776-2-0x0000000005360000-0x00000000053FC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2776-1-0x0000000074530000-0x0000000074CE0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2776-3-0x0000000005400000-0x0000000005466000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2776-4-0x0000000005540000-0x0000000005550000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2776-5-0x0000000006040000-0x00000000065E4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2776-6-0x0000000074530000-0x0000000074CE0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2776-7-0x0000000005540000-0x0000000005550000-memory.dmp

    Filesize

    64KB

    Download