Analysis
- max time kernel
134s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 17:14
General
- Target 95a3fc6b59f410da7cb82cfad6f8e25f_JaffaCakes118.exe
- Size 534KB
- Sample240604-vrydnadf8t
- SHA256 4494a60d6eb89d80d93eb50682240a69ee88e21ceae5f15639a93c912db9299d
Malware Config
Extracted
-
limerat
-
359Z6KxMenwvgkA7vpGeBtinJPTj5raZz8
-
aes_key
arglobal
-
antivm
false
-
c2_url
https://pastebin.com/raw/CV5RHE9G
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
- LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
- Drops startup file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95a3fc6b59f410da7cb82cfad6f8e25f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95a3fc6b59f410da7cb82cfad6f8e25f_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1680-0-0x0000000074FCE000-0x0000000074FCF000-memory.dmp
memory/1680-1-0x0000000000A30000-0x0000000000ABC000-memory.dmp
memory/1680-2-0x0000000002C10000-0x0000000002C42000-memory.dmp
memory/1680-3-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/1680-6-0x0000000074FC0000-0x0000000075770000-memory.dmp
memory/1680-36-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-40-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-44-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-42-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-38-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-34-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-33-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-30-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-28-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-26-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-24-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-22-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-20-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-56-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-58-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-60-0x0000000005410000-0x00000000054AC000-memory.dmp
memory/1680-59-0x00000000052B0000-0x00000000052BC000-memory.dmp
memory/1680-54-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-50-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-48-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-52-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-46-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-18-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-16-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-14-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-12-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-8-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-7-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-10-0x0000000002C60000-0x0000000002C7F000-memory.dmp
memory/1680-62-0x0000000074FC0000-0x0000000075770000-memory.dmp