limerat | 1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941

Analysis

max time kernel
30s
max time network
38s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07-07-2024 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New-Client.exe
Size

28KB
MD5

84da46d931269545f71141e7b44c78b6
SHA1

72468bc577e9642e0f2c30cfe8b298c019f92a60
SHA256

1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941
SHA512

8f897acd0b559d407ec2d9a4985f0579e14b58b9e4b2d252a62d0e433eb34549cf64918da1b799afe90e98e6098915805c3bfe3917df3895d3feba03dccb372b
SSDEEP

384:LB+Sbj6NKKR+6VFAHa0zCqDSsnejiZvDKNrCeJE3WNgh7zvdefzM2PoPnQro3lcv:1pKE6VFwabsneux45NkHvdezMT761j

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
4f2b3d5e6f7c9e2b5f4e3d1c2a3b6d8f9a7b6c3d
antivm
false
c2_url
https://pastebin.com/raw/d28E5Cx2
delay
3
download_payload
false
install
true
install_name
aidb.exe
main_folder
UserProfile
pin_spread
true
sub_folder
\sdfagre\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Executes dropped EXE 1 IoCs

Processes:

aidb.exe

pid process

3488 aidb.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

8 pastebin.com
1 pastebin.com
2 pastebin.com
3 pastebin.com
5 pastebin.com
6 pastebin.com
7 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3708 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

aidb.exe

description pid process

Token: SeDebugPrivilege 3488 aidb.exe
Token: SeDebugPrivilege 3488 aidb.exe

pid	process
3488	aidb.exe

flow	ioc
8	pastebin.com
1	pastebin.com
2	pastebin.com
3	pastebin.com
5	pastebin.com
6	pastebin.com
7	pastebin.com

pid	process
3708	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3488	aidb.exe
Token: SeDebugPrivilege	3488	aidb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

New-Client.exe

description	pid	process	target process
PID 336 wrote to memory of 3708	336	New-Client.exe	schtasks.exe
PID 336 wrote to memory of 3708	336	New-Client.exe	schtasks.exe
PID 336 wrote to memory of 3708	336	New-Client.exe	schtasks.exe
PID 336 wrote to memory of 3488	336	New-Client.exe	aidb.exe
PID 336 wrote to memory of 3488	336	New-Client.exe	aidb.exe
PID 336 wrote to memory of 3488	336	New-Client.exe	aidb.exe

C:\Users\Admin\AppData\Local\Temp\New-Client.exe
"C:\Users\Admin\AppData\Local\Temp\New-Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\sdfagre\aidb.exe'"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3708
- C:\Users\Admin\sdfagre\aidb.exe
  "C:\Users\Admin\sdfagre\aidb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sdfagre\aidb.exe

Filesize
28KB

MD5
84da46d931269545f71141e7b44c78b6

SHA1
72468bc577e9642e0f2c30cfe8b298c019f92a60

SHA256
1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941

SHA512
8f897acd0b559d407ec2d9a4985f0579e14b58b9e4b2d252a62d0e433eb34549cf64918da1b799afe90e98e6098915805c3bfe3917df3895d3feba03dccb372b

Download Submit
memory/336-0-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/336-1-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/336-2-0x00000000052C0000-0x000000000535C000-memory.dmp

Filesize
624KB

Download
memory/336-3-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/336-4-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/336-5-0x00000000060B0000-0x0000000006656000-memory.dmp

Filesize
5.6MB

Download
memory/336-16-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/3488-15-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/3488-17-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download