limerat | 729782176df07dcab88ca6d476c8b78b6b78a104d5df713a526cbf8baad1ddb5

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93a51bb3d03a1cebf76e63d8bdb3af04.exe
Size 684KB
Sample240206-ddldhaffdn
SHA256 729782176df07dcab88ca6d476c8b78b6b78a104d5df713a526cbf8baad1ddb5
MD5 93a51bb3d03a1cebf76e63d8bdb3af04
SHA1 0868306dcb3a1f21fdda94e7125ad3aa2ad2dfa9
SHA512 17c69bdbfbe71e80dbca83b967b6d9d77a4f63e0ea46b4c418ed7b3f318cda4603c8245b06a4d67a897baf8d8c2899bfb5da2932b0aea52d8c217752eeccc830
SSDEEP 12288:0JOpPEhZTl8pBRxhHLMmyLgIO3GsaMJcR/Vn+R9KVYszf:0JyPEhZB8pBlHomy0IO3GsId+R9KV1f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

limerat agilenet evasion rat trojan

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/tDBQY6gT
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x00060000000231f9-34.dat	disable_win_def

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WScript.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	93a51bb3d03a1cebf76e63d8bdb3af04.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
560	.exe
1480	temp.exe
4592	Window Security Notification.exe

Loads dropped DLL 3 IoCs

pid	Process
3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe
560	.exe
4592	Window Security Notification.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x00060000000231fa-19.dat	agile_net
behavioral2/files/0x00060000000231fa-27.dat	agile_net
behavioral2/files/0x0017000000023203-340.dat	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	pastebin.com
20	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2504	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	93a51bb3d03a1cebf76e63d8bdb3af04.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4436	powershell.exe
4436	powershell.exe
3796	powershell.exe
3796	powershell.exe
4640	powershell.exe
4640	powershell.exe
2364	powershell.exe
2364	powershell.exe
4680	powershell.exe
4680	powershell.exe
1400	powershell.exe
1400	powershell.exe
2588	powershell.exe
2588	powershell.exe
2696	powershell.exe
2696	powershell.exe
2492	powershell.exe
2492	powershell.exe
2808	powershell.exe
2808	powershell.exe
3880	powershell.exe
3880	powershell.exe
4436	powershell.exe
2364	powershell.exe
4640	powershell.exe
3796	powershell.exe
4680	powershell.exe
2492	powershell.exe
1400	powershell.exe
2588	powershell.exe
2696	powershell.exe
2808	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	temp.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	4592	Window Security Notification.exe
Token: SeDebugPrivilege	4592	Window Security Notification.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4084	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	85
PID 3956 wrote to memory of 4084	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	85
PID 3956 wrote to memory of 4084	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	85
PID 3956 wrote to memory of 560	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	86
PID 3956 wrote to memory of 560	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	86
PID 3956 wrote to memory of 560	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	86
PID 3956 wrote to memory of 1480	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	113
PID 3956 wrote to memory of 1480	3956	93a51bb3d03a1cebf76e63d8bdb3af04.exe	113
PID 4084 wrote to memory of 5008	4084	WScript.exe	87
PID 4084 wrote to memory of 5008	4084	WScript.exe	87
PID 4084 wrote to memory of 5008	4084	WScript.exe	87
PID 5008 wrote to memory of 3796	5008	WScript.exe	112
PID 5008 wrote to memory of 3796	5008	WScript.exe	112
PID 5008 wrote to memory of 3796	5008	WScript.exe	112
PID 5008 wrote to memory of 2364	5008	WScript.exe	103
PID 5008 wrote to memory of 2364	5008	WScript.exe	103
PID 5008 wrote to memory of 2364	5008	WScript.exe	103
PID 5008 wrote to memory of 4436	5008	WScript.exe	91
PID 5008 wrote to memory of 4436	5008	WScript.exe	91
PID 5008 wrote to memory of 4436	5008	WScript.exe	91
PID 5008 wrote to memory of 4640	5008	WScript.exe	92
PID 5008 wrote to memory of 4640	5008	WScript.exe	92
PID 5008 wrote to memory of 4640	5008	WScript.exe	92
PID 5008 wrote to memory of 4680	5008	WScript.exe	93
PID 5008 wrote to memory of 4680	5008	WScript.exe	93
PID 5008 wrote to memory of 4680	5008	WScript.exe	93
PID 5008 wrote to memory of 1400	5008	WScript.exe	95
PID 5008 wrote to memory of 1400	5008	WScript.exe	95
PID 5008 wrote to memory of 1400	5008	WScript.exe	95
PID 5008 wrote to memory of 2588	5008	WScript.exe	99
PID 5008 wrote to memory of 2588	5008	WScript.exe	99
PID 5008 wrote to memory of 2588	5008	WScript.exe	99
PID 5008 wrote to memory of 2696	5008	WScript.exe	98
PID 5008 wrote to memory of 2696	5008	WScript.exe	98
PID 5008 wrote to memory of 2696	5008	WScript.exe	98
PID 5008 wrote to memory of 2492	5008	WScript.exe	102
PID 5008 wrote to memory of 2492	5008	WScript.exe	102
PID 5008 wrote to memory of 2492	5008	WScript.exe	102
PID 5008 wrote to memory of 2808	5008	WScript.exe	105
PID 5008 wrote to memory of 2808	5008	WScript.exe	105
PID 5008 wrote to memory of 2808	5008	WScript.exe	105
PID 5008 wrote to memory of 3880	5008	WScript.exe	106
PID 5008 wrote to memory of 3880	5008	WScript.exe	106
PID 5008 wrote to memory of 3880	5008	WScript.exe	106
PID 560 wrote to memory of 2504	560	.exe	115
PID 560 wrote to memory of 2504	560	.exe	115
PID 560 wrote to memory of 2504	560	.exe	115
PID 560 wrote to memory of 4592	560	.exe	117
PID 560 wrote to memory of 4592	560	.exe	117
PID 560 wrote to memory of 4592	560	.exe	117

C:\Users\Admin\AppData\Local\Temp\93a51bb3d03a1cebf76e63d8bdb3af04.exe
"C:\Users\Admin\AppData\Local\Temp\93a51bb3d03a1cebf76e63d8bdb3af04.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\script.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\SysWOW64\WScript.exe" "C:\ProgramData\script.vbs" /elevate
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1400
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2808
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- C:\ProgramData\.exe
  "C:\ProgramData\.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\System32\Window Security Notification.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2504
- - C:\Users\Admin\System32\Window Security Notification.exe
    "C:\Users\Admin\System32\Window Security Notification.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\ProgramData\temp.exe
  "C:\ProgramData\temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.exe

Path C:\ProgramData\.exe
Size 313KB
SHA256 a96147860e86e8f6a898e7bf77c05596790595c10a63271a2dce89d56fc49dac
MD5 bfe968b719b9567e0914105d2f5f80a4
SHA1 de78dee76dec96235312fa82ebebc51f114483c9
SHA512 87040e0beacfdbce3a401e09bb912e67544f7f0cd8de6bacbf710fddd6ac5e143dca08049de006d844b8b50131de98f56faf953328f40aaedfa2675186d5d5d4
SSDEEP 6144:MmSZtQFHABixxlOpfet3Agp0q9ygbX+1RzDU8:M7Zt4DgsaMJcR/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

.exe

Path C:\ProgramData\.exe
Size 243KB
SHA256 e03ec41e1735f54fc7da61e176b15ab782935181f82b13700a82a9ad694140d0
MD5 cd161d9bc56bf90a84925c34d39d82b8
SHA1 67010969279885dfe4aa02e4924f92e5cb9e0e5a
SHA512 488729cc31a10d74ad7727c3355755a2c791755fd969fd39183177ce69738dfebe6e764bdcf04f7104a390cb8ed52440c3b25894ce1892818a727a011bd01a5c
SSDEEP 6144:MmSZtQFHABixxlOpfet3Agp0q9ygbX+1RzDa:M7Zt4DgsaMJcR/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.vbs

Path C:\ProgramData\script.vbs
Size 1KB
SHA256 038802b33f5e7179ad59105099681003c68fdb9b3c757540e737564c1b460533
MD5 dd82baf02caac1567f2277edca89a912
SHA1 36f5d8c2a67f31768b1116bb87f77b049ffd3f63
SHA512 6825e10fbb3fec3619cd0b2d36f6490f28301fd723fa9b2b52403aa3d8c2e39b7bb04eedc937c5fdf76f511e9e75e533ef6cfce07d398fe13b52896c3e343554
MD5 SHA1 SHA512

Submit Download

temp.exe

Path C:\ProgramData\temp.exe
Size 10KB
SHA256 80b261cf3b2206cd8786afd2b401b83dab0b97bf13d128d846910b61fde01876
MD5 c26e4cd9bc956f25ec249bcb75900ab2
SHA1 f2a80a50639ec0c5a438c867b37ca03df286017c
SHA512 71b9efcab7aae3da89e0694f29879ac786c465a9510d8b43f0ce5f629fdda3ab6be899992b7d6e94ad6ba7558cb8b4e6f29f572b188534f68e33a792e5308387
SSDEEP 96:LpwfFC8w4PH5y6jI2d1nbK/t79dCieQh+c7y7Q02vFu3utnZvVUvg61rEkrnKpgo:GfFBw4NIuFWN9dXebYue/ivprtRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download