limerat | 34d54fc11ec26dc3645995c8cad58d22976293e6af1ec3789cfab640ace146b4

General

Target

004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
Size

57KB
MD5

004317b8cf9bf0a8595424977cecddd0
SHA1

c934425794991d88255a7597118c940066342743
SHA256

34d54fc11ec26dc3645995c8cad58d22976293e6af1ec3789cfab640ace146b4
SHA512

6e8cffd8784f2c938746f713f0eadf46e6a07c984add2770c24ba6713c789ea6d956660486b3993787cf832a17e4df20f2c95a10a1eb425697e0b5a57080b6e1
SSDEEP

768:aWNc4ivigIwf+afPMwngwSGUIYKrBsDK9WL1C/GlI5tOGc9C45uD65R4UDiFHUBI:9zZO7fEwgwyIlrBd+JlcMbItYxxfrO

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
fSDFvase32f2@hj5
antivm
true
c2_url
https://pastebin.com/raw/iRwDeTN3
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
true

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/iRwDeTN3
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
Token: SeDebugPrivilege	2192	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28
PID 2112 wrote to memory of 2192	2112	004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x00000000012C0000-0x00000000012D4000-memory.dmp

Filesize
80KB

Download
memory/2112-1-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-2-0x0000000001260000-0x00000000012A0000-memory.dmp

Filesize
256KB

Download
memory/2112-3-0x00000000001E0000-0x00000000001EA000-memory.dmp

Filesize
40KB

Download
memory/2112-11-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2192-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-15-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-16-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2192-17-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-18-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads