limerat | 94286e8c12dccb3f8d0392a5de90d342fb11b530a47bd02370988d637b303cc0

General

Target

7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe
Size

28KB
MD5

08750b4bbc8a34a3f7e12bb6f9a71444
SHA1

400f42a7a1c9d7486ad7d07200a5a2908d71d231
SHA256

7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3
SHA512

81b25e17299f11b8487df0914471f85786d30983f87640eb6b4bbda2a21257a675085c32395694a49d00f8d7d0e01705a06f870c4d7729159fd0d62ed2eac5f0
SSDEEP

384:s/rLhJcl6QdgPxVHGhOaZJTGPuFW9vcCZjgD0kau3GXsW7ltIpjIhvGyvN9:s/rLhufgPhaumCvcvDauCWjIhvr

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
NKHUB
antivm
true
c2_url
https://pastebin.com/raw/K6zz3eth
delay
3
download_payload
false
install
true
install_name
svchost.exe
main_folder
Temp
pin_spread
false
sub_folder
\OdlaçddApdad\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2616 svchost.exe

pid	process
2616	svchost.exe

Loads dropped DLL 2 IoCs

Processes:

7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe

pid	process
1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe
1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1744 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2616 svchost.exe
Token: SeDebugPrivilege 2616 svchost.exe

pid	process
1744	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2616	svchost.exe
Token: SeDebugPrivilege	2616	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe

description	pid	process	target process
PID 1668 wrote to memory of 1744	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	schtasks.exe
PID 1668 wrote to memory of 1744	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	schtasks.exe
PID 1668 wrote to memory of 1744	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	schtasks.exe
PID 1668 wrote to memory of 1744	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	schtasks.exe
PID 1668 wrote to memory of 2616	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	svchost.exe
PID 1668 wrote to memory of 2616	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	svchost.exe
PID 1668 wrote to memory of 2616	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	svchost.exe
PID 1668 wrote to memory of 2616	1668	7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe
"C:\Users\Admin\AppData\Local\Temp\7e599c6aa3e49cbe46990cf8fd8803cb30e2255a2f21d6a1287e7ee4a2ff9fc3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab3C77.tmp

Filesize
23KB

MD5
adf8b03781bc55aed9641d7e45fd5bee

SHA1
0db9c02244aa6d498cfbb70af2ff5039b3a515f5

SHA256
d89e56ee544c247c619cdf6792e30a65639e031c8e04bad611189cf2586ed387

SHA512
536e816d4f0c1242763274e417317d17365cd5269fd8f197aca93810ea29292a497eb36706679653cc374679d5cae1223a35c7b697a31ab4ae024d248a47f17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe

Filesize
13KB

MD5
5c9ba3416334ae9f932c9bbfbd2528ec

SHA1
2f73c1a05c1e46df2fa56e8563ce1e55f4c0b466

SHA256
8f129033cf2d9ab60d32bccb0fac4a5df0dc6c62b17dbace95d33d9220e5f25a

SHA512
04e9a2c1d9195bd9244aecb8bf92f3a68b8323d09990248662ed1585a19acaadcdee99edb71f1b1cd412ce4b7e9789cfbb635fc33b6c99538f014654f8c41bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe

Filesize
1KB

MD5
f55d7fe3c9d7bcb21a0365ecc10f25d1

SHA1
2b7e3dbe23628b4158dfd2f7dafb35f451b540bb

SHA256
25cdf0121165f08c5ded812c81e7f82f01614ed42d53f420da3b49bc234a243d

SHA512
6c8f7d80188fdf511ef46c6ebae9372afaf50e50daaee801a44efb9e01f656f458d086c1b64db456f2d67a06b2adc970b60a08b3b775bb1f3f0794f9d749f192

Download Submit
C:\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe

Filesize
8KB

MD5
71c1532a0895bdaf4cf9b5abbcea8556

SHA1
cddb87fa3aaf29ce0721581f1df26191ce8810e4

SHA256
643e5511c6d19ece8143363d3b29313de64f45e1f7c2f209a25c76531e630db9

SHA512
9db3496c6ce6140179cd1d9c08580645846d98c2b9eae319b2b1c734cc245a3fdfb0468827ed448994e3a512136beb7babddbb12f6489fdef6a042df07ae62ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C8A.tmp

Filesize
52KB

MD5
bc19b8a8278b749a652d07379721fe84

SHA1
7d1388a33214c4e0756fc0f76ef8b282efdf9edd

SHA256
8d77cfc8138744fa75fa7e9159c8f505846517facb9fe66b34331c5360ab734e

SHA512
c69ae42f754457aae9c5f9f000a4b8b9038f8b30a3618aee75b80079496154ac3b8c2070863a41113181f9a8f3526468ddf930ea53f25a275fc0d62af9795d86

Download Submit
\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe

Filesize
18KB

MD5
8e690ead67d868c3df33231a93f85ff8

SHA1
81556bf0164625b3a322e2bbfce8358c60fdd446

SHA256
609341b693a9bbc9a4379c14d2af5b3385d8a622ad1cf064d0218bda253428f5

SHA512
2157a98e56dc174ffa370254cba794888b08e09e7de939f1287a67360e9d3f8fc401f02b6e2f8298ed452be3ed87076a05cae01f4b48f926190b54f2da5c4ea7

Download Submit
\Users\Admin\AppData\Local\Temp\OdlaçddApdad\svchost.exe

Filesize
23KB

MD5
6028d623713c701bb0361992addb5e14

SHA1
ae6d6b170d44231626f4b4b0311800d3ab7d376c

SHA256
a0648e060b8ddfb991be83d23bdde1d074412f0d0e652e4aafeb8af68667cf35

SHA512
14f98a5448693011c662a756fd2a8e9d3a27906bbe6f27b83e4d271a83bd4eb4fc837321193a8b6be2a1246580d95a91868612cdcf099ad9734629c5c01c26c1

Download Submit
memory/1668-15-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/1668-0-0x0000000000340000-0x000000000034C000-memory.dmp

Filesize
48KB

Download
memory/1668-2-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/1668-4-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/1668-1-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/2616-16-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-17-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2616-14-0x0000000000A90000-0x0000000000A9C000-memory.dmp

Filesize
48KB

Download
memory/2616-52-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-53-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads