limerat | 8b81b385a2646033343216dcdfd40463b127f36a0708dfcdc189e571d2add35f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c23d849b84bb757dc19ccd19a7c7c6c1.exe
Size

64KB
MD5

c23d849b84bb757dc19ccd19a7c7c6c1
SHA1

6f0eaa46dbfe8a7ff5596414118c0ba52a64b16d
SHA256

8b81b385a2646033343216dcdfd40463b127f36a0708dfcdc189e571d2add35f
SHA512

a16195078aad21dc47fe48ed514612dcc6af4e39fc2680d7095b2105a3fb9856e0022ab448a0a150b80167204d58f7d74c29793e9de1f31ef23f742650ce28c8
SSDEEP

768:cWvDGHFPHc5b3U+KOT/NO1lgA9SkuTdIbf+iK6shRoJv0wtVbG+HdyJW5wmy3OOP:cZlPg3U+jT+KGq6shR8vHD5wi4OOP

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/NzAFK8As
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	c23d849b84bb757dc19ccd19a7c7c6c1.exe

Executes dropped EXE 1 IoCs

pid	Process
4940	WindowsServices.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
416	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	WindowsServices.exe
Token: SeDebugPrivilege	4940	WindowsServices.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 416	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	93
PID 1308 wrote to memory of 416	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	93
PID 1308 wrote to memory of 416	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	93
PID 1308 wrote to memory of 4940	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	95
PID 1308 wrote to memory of 4940	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	95
PID 1308 wrote to memory of 4940	1308	c23d849b84bb757dc19ccd19a7c7c6c1.exe	95

C:\Users\Admin\AppData\Local\Temp\c23d849b84bb757dc19ccd19a7c7c6c1.exe
"C:\Users\Admin\AppData\Local\Temp\c23d849b84bb757dc19ccd19a7c7c6c1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\Sys\WindowsServices.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:416
- C:\Users\Admin\Sys\WindowsServices.exe
  "C:\Users\Admin\Sys\WindowsServices.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Sys\WindowsServices.exe

Filesize
64KB

MD5
c23d849b84bb757dc19ccd19a7c7c6c1

SHA1
6f0eaa46dbfe8a7ff5596414118c0ba52a64b16d

SHA256
8b81b385a2646033343216dcdfd40463b127f36a0708dfcdc189e571d2add35f

SHA512
a16195078aad21dc47fe48ed514612dcc6af4e39fc2680d7095b2105a3fb9856e0022ab448a0a150b80167204d58f7d74c29793e9de1f31ef23f742650ce28c8

Download Submit
C:\Users\Admin\Sys\WindowsServices.exe

Filesize
27KB

MD5
9ee8f043e7a98ae44979609a183266ff

SHA1
8e559d3548a534d921c09b4d23ed79cfa4f699ce

SHA256
4bbef6ac4e409f468301895b9de4ac60c99713c8ce663f8253dce0d4fbd9f1e8

SHA512
7d56a451459583fa510bb743e7c610b9a0e5d7f22f9f62116886f6602e5968f72512f12e9547c76726d1243eab7d5061045e924ad15567e834000a7bfe18aab9

Download Submit
C:\Users\Admin\Sys\WindowsServices.exe

Filesize
29KB

MD5
b5cb8d43266a185ab61dbca2cb96c7c8

SHA1
9960f7b423caea8b861c086a4e4ae7c6ec175138

SHA256
b4d2151561cfe61463e422ae674b59dba2eb58cd9c836cb0e1c47588cfc95784

SHA512
397024820f0d8a747da51645f607aaaf7ea034b4cbd2d0858cb4eeb0997681944ec8d10d985bd1f99f541d9b7420d2c8d271320f67b80af86ee6a989f94d0104

Download Submit
memory/1308-3-0x00000000051D0000-0x0000000005236000-memory.dmp

Filesize
408KB

Download
memory/1308-4-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/1308-5-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/1308-1-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/1308-2-0x00000000050D0000-0x000000000516C000-memory.dmp

Filesize
624KB

Download
memory/1308-15-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/1308-0-0x0000000000740000-0x0000000000754000-memory.dmp

Filesize
80KB

Download
memory/4940-16-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/4940-17-0x00000000023F0000-0x0000000002400000-memory.dmp

Filesize
64KB

Download
memory/4940-18-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/4940-19-0x00000000023F0000-0x0000000002400000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads