limerat | 61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1

General

Target

f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
Size

111KB
MD5

f41c8229b3c54c3ff51191372d9cb790
SHA1

c4d57e6f2b94060a94c4f84863a597c2ef58651d
SHA256

61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1
SHA512

df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11
SSDEEP

1536:eR+7RKzXHFJOgDmUiApuj9bcqRaJB2d+JutQNGKZPPXveSxIYjT:eRSKzXlkgC7AKgJSCAY/

Score

10^/10

limerat vjw0rm persistence rat trojan worm

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/G9wX4J5m
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exeNew-Client.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	New-Client.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe

Executes dropped EXE 2 IoCs

Processes:

New-Client.exeplayer.exe

pid process

3192 New-Client.exe
1556 player.exe

pid	process
3192	New-Client.exe
1556	player.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JXSCMTN53F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

32 pastebin.com
31 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4384 schtasks.exe
3616 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

player.exe

description pid process

Token: SeDebugPrivilege 1556 player.exe
Token: SeDebugPrivilege 1556 player.exe

flow	ioc
32	pastebin.com
31	pastebin.com

pid	process
4384	schtasks.exe
3616	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1556	player.exe
Token: SeDebugPrivilege	1556	player.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

wscript.exewscript.exeNew-Client.exe

description	pid	process	target process
PID 2088 wrote to memory of 3408	2088	wscript.exe	wscript.exe
PID 2088 wrote to memory of 3408	2088	wscript.exe	wscript.exe
PID 2088 wrote to memory of 4384	2088	wscript.exe	schtasks.exe
PID 2088 wrote to memory of 4384	2088	wscript.exe	schtasks.exe
PID 3408 wrote to memory of 3192	3408	wscript.exe	New-Client.exe
PID 3408 wrote to memory of 3192	3408	wscript.exe	New-Client.exe
PID 3408 wrote to memory of 3192	3408	wscript.exe	New-Client.exe
PID 3192 wrote to memory of 3616	3192	New-Client.exe	schtasks.exe
PID 3192 wrote to memory of 3616	3192	New-Client.exe	schtasks.exe
PID 3192 wrote to memory of 3616	3192	New-Client.exe	schtasks.exe
PID 3192 wrote to memory of 1556	3192	New-Client.exe	player.exe
PID 3192 wrote to memory of 1556	3192	New-Client.exe	player.exe
PID 3192 wrote to memory of 1556	3192	New-Client.exe	player.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3408

C:\Users\Admin\AppData\Roaming\New-Client.exe
"C:\Users\Admin\AppData\Roaming\New-Client.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"
4⤵
- Creates scheduled task(s)
PID:3616

C:\Users\Admin\AppData\Roaming\player.exe
"C:\Users\Admin\AppData\Roaming\player.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
2⤵
- Creates scheduled task(s)
PID:4384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\New-Client.exe
Filesize
28KB

MD5
1ad564a6ca1520e8886faffc4e0ff1d4

SHA1
7d3b61daef1afed73838351dbf788448cf88d031

SHA256
2c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4

SHA512
b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441

Download Submit
C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js
Filesize
55KB

MD5
676c61e12789321127ee39d4f6040e6e

SHA1
d28eb6214cc3b5659d758ac1f64c7ad0d9a1d0f5

SHA256
c2ac77ca98d95ffa6ad11691c395bf22c564ab87f8dfad3211533a215b89d28b

SHA512
439218663821587f1727d7b833dae0991b75ae9f0e5a0761c72984758b3f1750fdca7242f1f8d9626561c3eeab826892d190112b901b1f632df75c820f67e5f8

Download Submit
memory/1556-24-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-25-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/1556-26-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-27-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-28-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/3192-11-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/3192-12-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/3192-13-0x0000000001240000-0x0000000001250000-memory.dmp

Filesize
64KB

Download
memory/3192-23-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads