limerat | 1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941

Analysis

max time kernel
30s
max time network
38s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07-07-2024 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New-Client.exe
Size

28KB
MD5

84da46d931269545f71141e7b44c78b6
SHA1

72468bc577e9642e0f2c30cfe8b298c019f92a60
SHA256

1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941
SHA512

8f897acd0b559d407ec2d9a4985f0579e14b58b9e4b2d252a62d0e433eb34549cf64918da1b799afe90e98e6098915805c3bfe3917df3895d3feba03dccb372b
SSDEEP

384:LB+Sbj6NKKR+6VFAHa0zCqDSsnejiZvDKNrCeJE3WNgh7zvdefzM2PoPnQro3lcv:1pKE6VFwabsneux45NkHvdezMT761j

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
4f2b3d5e6f7c9e2b5f4e3d1c2a3b6d8f9a7b6c3d
antivm
false
c2_url
https://pastebin.com/raw/d28E5Cx2
delay
3
download_payload
false
install
true
install_name
aidb.exe
main_folder
UserProfile
pin_spread
true
sub_folder
\sdfagre\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Executes dropped EXE 1 IoCs

pid	Process
3488	aidb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
1	pastebin.com
2	pastebin.com
3	pastebin.com
5	pastebin.com
6	pastebin.com
7	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3708	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	aidb.exe
Token: SeDebugPrivilege	3488	aidb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 3708	336	New-Client.exe	79
PID 336 wrote to memory of 3708	336	New-Client.exe	79
PID 336 wrote to memory of 3708	336	New-Client.exe	79
PID 336 wrote to memory of 3488	336	New-Client.exe	81
PID 336 wrote to memory of 3488	336	New-Client.exe	81
PID 336 wrote to memory of 3488	336	New-Client.exe	81

C:\Users\Admin\AppData\Local\Temp\New-Client.exe
"C:\Users\Admin\AppData\Local\Temp\New-Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\sdfagre\aidb.exe'"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3708
- C:\Users\Admin\sdfagre\aidb.exe
  "C:\Users\Admin\sdfagre\aidb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sdfagre\aidb.exe

Filesize
28KB

MD5
84da46d931269545f71141e7b44c78b6

SHA1
72468bc577e9642e0f2c30cfe8b298c019f92a60

SHA256
1bf99ff57e5e9ce74f1e53fb0642e40b5b100642e8c901ca8791e43e4f777941

SHA512
8f897acd0b559d407ec2d9a4985f0579e14b58b9e4b2d252a62d0e433eb34549cf64918da1b799afe90e98e6098915805c3bfe3917df3895d3feba03dccb372b

Download Submit
memory/336-0-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/336-1-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/336-2-0x00000000052C0000-0x000000000535C000-memory.dmp

Filesize
624KB

Download
memory/336-3-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/336-4-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/336-5-0x00000000060B0000-0x0000000006656000-memory.dmp

Filesize
5.6MB

Download
memory/336-16-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/3488-15-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download
memory/3488-17-0x0000000074440000-0x0000000074BF1000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads