limerat | 61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1

General

Target

f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
Size

111KB
MD5

f41c8229b3c54c3ff51191372d9cb790
SHA1

c4d57e6f2b94060a94c4f84863a597c2ef58651d
SHA256

61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1
SHA512

df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11
SSDEEP

1536:eR+7RKzXHFJOgDmUiApuj9bcqRaJB2d+JutQNGKZPPXveSxIYjT:eRSKzXlkgC7AKgJSCAY/

Score

10^/10

limerat vjw0rm persistence rat trojan worm

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/G9wX4J5m
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe

Executes dropped EXE 2 IoCs

Processes:

New-Client.exeplayer.exe

pid process

3032 New-Client.exe
1632 player.exe
Loads dropped DLL 2 IoCs

Processes:

New-Client.exe

pid process

3032 New-Client.exe
3032 New-Client.exe

pid	process
3032	New-Client.exe
1632	player.exe

pid	process
3032	New-Client.exe
3032	New-Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\JXSCMTN53F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

7 pastebin.com
6 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2732 schtasks.exe
268 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

player.exe

description pid process

Token: SeDebugPrivilege 1632 player.exe
Token: SeDebugPrivilege 1632 player.exe

flow	ioc
7	pastebin.com
6	pastebin.com

pid	process
2732	schtasks.exe
268	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1632	player.exe
Token: SeDebugPrivilege	1632	player.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

wscript.exewscript.exeNew-Client.exe

description	pid	process	target process
PID 2784 wrote to memory of 2552	2784	wscript.exe	wscript.exe
PID 2784 wrote to memory of 2552	2784	wscript.exe	wscript.exe
PID 2784 wrote to memory of 2552	2784	wscript.exe	wscript.exe
PID 2784 wrote to memory of 2732	2784	wscript.exe	schtasks.exe
PID 2784 wrote to memory of 2732	2784	wscript.exe	schtasks.exe
PID 2784 wrote to memory of 2732	2784	wscript.exe	schtasks.exe
PID 2552 wrote to memory of 3032	2552	wscript.exe	New-Client.exe
PID 2552 wrote to memory of 3032	2552	wscript.exe	New-Client.exe
PID 2552 wrote to memory of 3032	2552	wscript.exe	New-Client.exe
PID 2552 wrote to memory of 3032	2552	wscript.exe	New-Client.exe
PID 3032 wrote to memory of 268	3032	New-Client.exe	schtasks.exe
PID 3032 wrote to memory of 268	3032	New-Client.exe	schtasks.exe
PID 3032 wrote to memory of 268	3032	New-Client.exe	schtasks.exe
PID 3032 wrote to memory of 268	3032	New-Client.exe	schtasks.exe
PID 3032 wrote to memory of 1632	3032	New-Client.exe	player.exe
PID 3032 wrote to memory of 1632	3032	New-Client.exe	player.exe
PID 3032 wrote to memory of 1632	3032	New-Client.exe	player.exe
PID 3032 wrote to memory of 1632	3032	New-Client.exe	player.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Users\Admin\AppData\Roaming\New-Client.exe
"C:\Users\Admin\AppData\Roaming\New-Client.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"
4⤵
- Creates scheduled task(s)
PID:268

C:\Users\Admin\AppData\Roaming\player.exe
"C:\Users\Admin\AppData\Roaming\player.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
2⤵
- Creates scheduled task(s)
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\New-Client.exe
Filesize
28KB

MD5
1ad564a6ca1520e8886faffc4e0ff1d4

SHA1
7d3b61daef1afed73838351dbf788448cf88d031

SHA256
2c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4

SHA512
b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441

Download Submit
C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js
Filesize
55KB

MD5
676c61e12789321127ee39d4f6040e6e

SHA1
d28eb6214cc3b5659d758ac1f64c7ad0d9a1d0f5

SHA256
c2ac77ca98d95ffa6ad11691c395bf22c564ab87f8dfad3211533a215b89d28b

SHA512
439218663821587f1727d7b833dae0991b75ae9f0e5a0761c72984758b3f1750fdca7242f1f8d9626561c3eeab826892d190112b901b1f632df75c820f67e5f8

Download Submit
memory/1632-26-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

Filesize
256KB

Download
memory/1632-25-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-27-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-11-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-12-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-13-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/3032-24-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads