limerat | d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

General

Target

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
Size

1.2MB
MD5

5dcb26cbf1c756d107fdbe32fb41c1c3
SHA1

1def45e69c25fbddcb11858ea9d765ad1ca4e4c5
SHA256

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb
SHA512

eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1
SSDEEP

24576:jpHeEsbf+XmWAn5oG8h/NANypdHgSOs1NSV9EDgYoWnC0/vvDJ:Vxszv35GlNAadHw+NSV9EDgNev

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
123
antivm
true
c2_url
https://pastebin.com/raw/Pwvd6TXb
delay
3
download_payload
false
install
true
install_name
Bhop.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
true

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/Pwvd6TXb
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe

Executes dropped EXE 1 IoCs

Processes:

Bhop.exe

pid process

4940 Bhop.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
4940	Bhop.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

Processes:

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exeBhop.exe

pid	process
2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

LimeRat 3 IoCs

LimeRat.

Processes:

resource	yara_rule
behavioral2/memory/2080-2-0x0000000000520000-0x00000000008D4000-memory.dmp	Backdoor_Win32_LimeRAT
behavioral2/memory/2080-19-0x0000000000520000-0x00000000008D4000-memory.dmp	Backdoor_Win32_LimeRAT
behavioral2/memory/4940-20-0x00000000000F0000-0x00000000004A4000-memory.dmp	Backdoor_Win32_LimeRAT

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5088 schtasks.exe

pid	process
5088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exeBhop.exe

pid	process
2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe
4940	Bhop.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Bhop.exe

description pid process

Token: SeDebugPrivilege 4940 Bhop.exe
Token: SeDebugPrivilege 4940 Bhop.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exeBhop.exe

pid process

2080 d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
4940 Bhop.exe

description	pid	process
Token: SeDebugPrivilege	4940	Bhop.exe
Token: SeDebugPrivilege	4940	Bhop.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe

description	pid	process	target process
PID 2080 wrote to memory of 5088	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	schtasks.exe
PID 2080 wrote to memory of 5088	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	schtasks.exe
PID 2080 wrote to memory of 5088	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	schtasks.exe
PID 2080 wrote to memory of 4940	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	Bhop.exe
PID 2080 wrote to memory of 4940	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	Bhop.exe
PID 2080 wrote to memory of 4940	2080	d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe	Bhop.exe

C:\Users\Admin\AppData\Local\Temp\d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe
"C:\Users\Admin\AppData\Local\Temp\d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Bhop.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:5088
- C:\Users\Admin\AppData\Roaming\Bhop.exe
  "C:\Users\Admin\AppData\Roaming\Bhop.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bhop.exe

Filesize
1.2MB

MD5
5dcb26cbf1c756d107fdbe32fb41c1c3

SHA1
1def45e69c25fbddcb11858ea9d765ad1ca4e4c5

SHA256
d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

SHA512
eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1

Download Submit
C:\Users\Admin\AppData\Roaming\Bhop.exe

Filesize
1.2MB

MD5
5dcb26cbf1c756d107fdbe32fb41c1c3

SHA1
1def45e69c25fbddcb11858ea9d765ad1ca4e4c5

SHA256
d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

SHA512
eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1

Download Submit
C:\Users\Admin\AppData\Roaming\Bhop.exe

Filesize
1.2MB

MD5
5dcb26cbf1c756d107fdbe32fb41c1c3

SHA1
1def45e69c25fbddcb11858ea9d765ad1ca4e4c5

SHA256
d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

SHA512
eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1

Download Submit
memory/2080-4-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/2080-21-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-5-0x0000000006140000-0x0000000006150000-memory.dmp

Filesize
64KB

Download
memory/2080-7-0x0000000006DC0000-0x0000000007364000-memory.dmp

Filesize
5.6MB

Download
memory/2080-3-0x0000000005FC0000-0x000000000605C000-memory.dmp

Filesize
624KB

Download
memory/2080-2-0x0000000000520000-0x00000000008D4000-memory.dmp

Filesize
3.7MB

Download
memory/2080-1-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-0-0x0000000000520000-0x00000000008D4000-memory.dmp

Filesize
3.7MB

Download
memory/2080-19-0x0000000000520000-0x00000000008D4000-memory.dmp

Filesize
3.7MB

Download
memory/4940-22-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4940-16-0x00000000000F0000-0x00000000004A4000-memory.dmp

Filesize
3.7MB

Download
memory/4940-20-0x00000000000F0000-0x00000000004A4000-memory.dmp

Filesize
3.7MB

Download
memory/4940-23-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/4940-26-0x00000000000F0000-0x00000000004A4000-memory.dmp

Filesize
3.7MB

Download
memory/4940-27-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4940-28-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads