limerat | 861b6c9421ebe142f5a3c13817190ab30b5b7b5e68692e886639589b784086e4

General

Target

267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe
Size

625KB
MD5

267a4c85d232e2ac38129146e11076fe
SHA1

1e8022b879ee79f2fe86ecac410a116b05ac0112
SHA256

861b6c9421ebe142f5a3c13817190ab30b5b7b5e68692e886639589b784086e4
SHA512

793acc93adfe3c116674bf0ab4122ebe41335dd525034ca78f5f59408976fe62a27ce98a9cbebffa476186324447083f59ecdfa210fac4f872476adedb911567
SSDEEP

12288:iSJcHRFHvJTjucJ71RXKvGgKsfUReclQ42dFA3ADj6Dl18WlL0u:2RFHv5jDJDNmKlQ1dFAr0x

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

359Z6KxMenwvgkA7vpGeBtinJPTj5raZz8

Attributes

aes_key
arglobal
antivm
false
c2_url
https://pastebin.com/raw/CV5RHE9G
delay
3
download_payload
true
install
false
install_name
Wservices.exe
main_folder
AppData
payload_url
http://23.249.161.100/zaher/zna.exe
pin_spread
false
sub_folder
\vbc\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbc.url	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe
1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3028	1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe	81
PID 1360 wrote to memory of 3028	1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe	81
PID 1360 wrote to memory of 3028	1360	267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\267a4c85d232e2ac38129146e11076fe_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-0-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/1360-1-0x0000000000C40000-0x0000000000CE4000-memory.dmp

Filesize
656KB

Download
memory/1360-2-0x00000000055F0000-0x0000000005674000-memory.dmp

Filesize
528KB

Download
memory/1360-3-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1360-4-0x0000000005680000-0x00000000056B2000-memory.dmp

Filesize
200KB

Download
memory/1360-5-0x00000000056B0000-0x00000000056D6000-memory.dmp

Filesize
152KB

Download
memory/1360-8-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-23-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-55-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-59-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-60-0x0000000005710000-0x000000000571C000-memory.dmp

Filesize
48KB

Download
memory/1360-61-0x00000000057F0000-0x000000000588C000-memory.dmp

Filesize
624KB

Download
memory/1360-63-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1360-57-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-53-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-51-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-49-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-47-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-45-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-43-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-41-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-35-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-33-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-31-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-29-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-39-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-37-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-27-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-25-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-21-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-19-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-17-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-15-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-13-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-11-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download
memory/1360-9-0x00000000056B0000-0x00000000056CF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing