limerat | 0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d.exe
Size

28KB
MD5

7d56d6a7a982e07625092cc80311f54b
SHA1

7715c0abcef845315f52241505b9a9a63456dac3
SHA256

0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d
SHA512

20de93cbbe83687d6b575e67473ecffdc2ac35b1b7379d9787b6a0c9cd942e3a8e9a16e5dae61b81e3a8ce173ba80b1b0ea2a64fdf675c4365b0b8ac0f798fdc
SSDEEP

384:EB+Sbj6NKnZm6OiAH5iIxqDncN4v0ar7vDKNrCeJE3WNgyKP5so2iFEQro3lcGVQ:Cpno6Oiw5Kc2vxL45N7KPNFmwj

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
123
antivm
false
c2_url
https://pastebin.com/87BkkfZk
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	pastebin.com
31	pastebin.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d.exe
Token: SeDebugPrivilege	3044	0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d.exe

C:\Users\Admin\AppData\Local\Temp\0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d.exe
"C:\Users\Admin\AppData\Local\Temp\0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x000000007532E000-0x000000007532F000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x00000000000C0000-0x00000000000CC000-memory.dmp

Filesize
48KB

Download
memory/3044-2-0x0000000004930000-0x00000000049CC000-memory.dmp

Filesize
624KB

Download
memory/3044-3-0x00000000049D0000-0x0000000004A36000-memory.dmp

Filesize
408KB

Download
memory/3044-4-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/3044-5-0x00000000055F0000-0x0000000005B94000-memory.dmp

Filesize
5.6MB

Download
memory/3044-6-0x000000007532E000-0x000000007532F000-memory.dmp

Filesize
4KB

Download
memory/3044-7-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download