limerat | deed0b5cab2da69b09bdfba22ee202bd65a035654bed86bab1f3e52f168d682c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 10:23

Target

043c61b8a76334ad6d6a0c54e20343f4.exe
Size

75KB
MD5

043c61b8a76334ad6d6a0c54e20343f4
SHA1

30f59cbc3a37a73c3639781be6b0f8d87000ab9b
SHA256

deed0b5cab2da69b09bdfba22ee202bd65a035654bed86bab1f3e52f168d682c
SHA512

ff0e7d6c48070efff7b5b0e50723183885fb48192356153d90efa3a0f70cfe86d935ae425dc3ef546af5b3c0371359ddf7a44f7a41b960271a5b2289e264b50d
SSDEEP

1536:dZ8yh449pbbX9ydnfTjvrXoqAExrj2nOyM0pCpPnguvU9tj3hzlpVdcis:dbp9pEXjo8j2ZIvU9LIi

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28
PID 2204 wrote to memory of 2316	2204	043c61b8a76334ad6d6a0c54e20343f4.exe	28

C:\Users\Admin\AppData\Local\Temp\043c61b8a76334ad6d6a0c54e20343f4.exe
"C:\Users\Admin\AppData\Local\Temp\043c61b8a76334ad6d6a0c54e20343f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204
- \??\c:\windows\SysWOW64\notepad.exe
  "c:\windows\system32\notepad.exe"
  2⤵
  PID:2316

memory/2316-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2316-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2316-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2316-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2316-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download