limerat | 96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32.exe
Size

28KB
MD5

9af681e2accc0a497f06831ba5ad2801
SHA1

fef3edc7cbc6aed2034143ca6cd62ecb1fa49839
SHA256

96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32
SHA512

67a3215ec2538d8e2b583c840f34fc44734207880532d206ce770425588a0ac25ee2d6425187df2f479cea47435bb7ce2a6ba3e51b3d45c7669a962cfe446bd4
SSDEEP

384:EB+Sbj6NKYcYvR62u3AHtOEtCqDQj51AvDKNrCeJE3WNgFWOoOepojEspAetLfQC:CpYcYZ62u3wtmj51u45NYjeWnpbXxvj

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
1
antivm
false
c2_url
https://pastebin.com/raw/DDTVwwbu
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
34	pastebin.com
3	pastebin.com
16	pastebin.com
19	pastebin.com
20	pastebin.com
23	pastebin.com
8	pastebin.com
14	pastebin.com
17	pastebin.com
18	pastebin.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32.exe
Token: SeDebugPrivilege	4844	96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32.exe

C:\Users\Admin\AppData\Local\Temp\96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32.exe
"C:\Users\Admin\AppData\Local\Temp\96823cdc1c4e14f1927f4129ddb67dce8f3e3b7e88b7a4c1466aaeab7ae41b32.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/4844-1-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/4844-2-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/4844-3-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/4844-4-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/4844-5-0x0000000006310000-0x00000000068B4000-memory.dmp

Filesize
5.6MB

Download
memory/4844-6-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/4844-7-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download