limerat | c1dffe77b69ec5b8391248b6bf4298c54c94d9a1c01981c9f1716f334fb68db6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 17:51

Target

2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe
Size

48KB
MD5

c20c648c76065d7a425c06c78582d36b
SHA1

2dc519f290b3ce875a0d4116f7f78e8725a6f054
SHA256

c1dffe77b69ec5b8391248b6bf4298c54c94d9a1c01981c9f1716f334fb68db6
SHA512

05114d2fded1b7cba6f4248fd91e093a8fa77c4dd51e146732ac7359773423189da0e2ca70ae111279fb938b90129bc7fc01da1bbf7186fcffaafc15662f780a
SSDEEP

768:0ekMvI8QaB4oiErJ9QpYDdFMgdUU+dwHo:0xQ8ErfQpYnsU+d

Score

10^/10

limerat rat

Family

limerat

Attributes

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2380	2988	2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe	28
PID 2988 wrote to memory of 2380	2988	2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe	28
PID 2988 wrote to memory of 2380	2988	2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe	28
PID 2988 wrote to memory of 2380	2988	2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2192-2-0x00000000001C0000-0x00000000001CC000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 504
  2⤵
  - Program crash
  PID:2380

memory/2988-0-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/2988-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download