limerat | e01a285adbb9fd9e374eb939ae1f0685a10e2ceb480d8e8b88c88575c0a5b698

General

Target

4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe
Size

116KB
MD5

4d22cfac14da3907e94b3825ac4875b5
SHA1

4cb321980a55116ba0d35b21aaf1fe7e08250e70
SHA256

e01a285adbb9fd9e374eb939ae1f0685a10e2ceb480d8e8b88c88575c0a5b698
SHA512

8a20b57040873d11aa35cf3dbd8d25888cd7dc0ff3577697f085b6d96e00b4a04b2f0b52950dd90f45883cfb382fffde4c8cad9dbec9e72710e702847f9c2733
SSDEEP

3072:2x7XWKnCVQPF2UnX2mkpzT2qWWYQhRrKH:28KCy/nVkBdDx

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
killisrael
antivm
false
c2_url
https://pastebin.com/raw/v9J7B6vz
delay
3
download_payload
false
install
true
install_name
killisrael.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/v9J7B6vz
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Executes dropped EXE 1 IoCs

Processes:

killisrael.exe

pid process

2656 killisrael.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3048 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

killisrael.exe

description pid process

Token: SeDebugPrivilege 2656 killisrael.exe
Token: SeDebugPrivilege 2656 killisrael.exe

pid	process
2656	killisrael.exe

flow	ioc
4	pastebin.com
5	pastebin.com

pid	process
3048	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2656	killisrael.exe
Token: SeDebugPrivilege	2656	killisrael.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe

description	pid	process	target process
PID 2052 wrote to memory of 3048	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	schtasks.exe
PID 2052 wrote to memory of 3048	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	schtasks.exe
PID 2052 wrote to memory of 3048	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	schtasks.exe
PID 2052 wrote to memory of 2656	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	killisrael.exe
PID 2052 wrote to memory of 2656	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	killisrael.exe
PID 2052 wrote to memory of 2656	2052	4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe	killisrael.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d22cfac14da3907e94b3825ac4875b5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\killisrael.exe'"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Users\Admin\AppData\Local\Temp\killisrael.exe
"C:\Users\Admin\AppData\Local\Temp\killisrael.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\killisrael.exe
Filesize
116KB

MD5
4d22cfac14da3907e94b3825ac4875b5

SHA1
4cb321980a55116ba0d35b21aaf1fe7e08250e70

SHA256
e01a285adbb9fd9e374eb939ae1f0685a10e2ceb480d8e8b88c88575c0a5b698

SHA512
8a20b57040873d11aa35cf3dbd8d25888cd7dc0ff3577697f085b6d96e00b4a04b2f0b52950dd90f45883cfb382fffde4c8cad9dbec9e72710e702847f9c2733

Download Submit
memory/2052-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2052-1-0x0000000000D60000-0x0000000000D84000-memory.dmp

Filesize
144KB

Download
memory/2052-2-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/2052-3-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2052-4-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/2052-11-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-10-0x00000000009C0000-0x00000000009E4000-memory.dmp

Filesize
144KB

Download
memory/2656-12-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-13-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-14-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads