limerat | bc85a3b0adcb02cf50469381af6d0ba9ece084774a905e001aa93b2052857fcb

General

Target

63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe
Size

64KB
MD5

63df89be98d9252ff824bbefb02ec36a
SHA1

50ded468c9a9408fd4103ce44a5ce37fa22ef1ff
SHA256

bc85a3b0adcb02cf50469381af6d0ba9ece084774a905e001aa93b2052857fcb
SHA512

a3aa27c310530139597e93623bc4c1d908664452a9676ea2f2211691169287a1e12953d471e5f34297b1b7ca8c0bb127c75b7ff14c9324b598dba493f9bf679a
SSDEEP

1536:xtFFQ7Rw9l1hnyI9St5v57J2HCMxGGA1FVr9jV9CqE:xtDERanMvFAHHhAFfDy

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
dame
antivm
false
c2_url
https://pastebin.com/raw/dPL0gsvg
delay
3
download_payload
false
install
true
install_name
israel.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/dPL0gsvg
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
2656	israel.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2420	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	israel.exe
Token: SeDebugPrivilege	2656	israel.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2420	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2420	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2420	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2656	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2656	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2656	3028	63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63df89be98d9252ff824bbefb02ec36a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\israel.exe'"
  2⤵
  - Creates scheduled task(s)
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\israel.exe
  "C:\Users\Admin\AppData\Local\Temp\israel.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8638.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\israel.exe

Filesize
64KB

MD5
63df89be98d9252ff824bbefb02ec36a

SHA1
50ded468c9a9408fd4103ce44a5ce37fa22ef1ff

SHA256
bc85a3b0adcb02cf50469381af6d0ba9ece084774a905e001aa93b2052857fcb

SHA512
a3aa27c310530139597e93623bc4c1d908664452a9676ea2f2211691169287a1e12953d471e5f34297b1b7ca8c0bb127c75b7ff14c9324b598dba493f9bf679a

Download Submit
memory/2656-12-0x000000001ACB0000-0x000000001AD30000-memory.dmp

Filesize
512KB

Download
memory/2656-52-0x000000001ACB0000-0x000000001AD30000-memory.dmp

Filesize
512KB

Download
memory/2656-51-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-10-0x0000000000AB0000-0x0000000000AC6000-memory.dmp

Filesize
88KB

Download
memory/2656-11-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-3-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/3028-13-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-4-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/3028-0-0x00000000011F0000-0x0000000001206000-memory.dmp

Filesize
88KB

Download
memory/3028-2-0x000000001B450000-0x000000001B4D0000-memory.dmp

Filesize
512KB

Download
memory/3028-1-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads