limerat | dd209b50e0feb6e778d19457d6b8f5f4eeb3d0aec567521cc6688973521d693d

General

Target

6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe
Size

166KB
MD5

6031245730bb86ee6c6787883d814de8
SHA1

092b50c20b455e17dd8bb45ad920882b4c3d8bde
SHA256

dd209b50e0feb6e778d19457d6b8f5f4eeb3d0aec567521cc6688973521d693d
SHA512

410d603df8f86936ce1443dc6e115b1124e61ee17afad5abd3f798cb745af17a1b5be583e908d7039f1e6e027a286beb3980365eeb665c2e8736934b390211d9
SSDEEP

3072:xsSX7oMV7tP5PO6vLOrn2Nc6UxTgPqKktyZcoiW5AgvFvmt/dvIB9n96t:68h7J5PDCzplxTgCZtyZiW5Ax5dv2a

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/v9J7B6vz
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Executes dropped EXE 1 IoCs

Processes:

killisrael.exe

pid process

2832 killisrael.exe
Loads dropped DLL 1 IoCs

Processes:

6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe

pid process

2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1304 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

killisrael.exe

description pid process

Token: SeDebugPrivilege 2832 killisrael.exe
Token: SeDebugPrivilege 2832 killisrael.exe

pid	process
2832	killisrael.exe

pid	process
2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe

flow	ioc
4	pastebin.com
5	pastebin.com

pid	process
1304	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2832	killisrael.exe
Token: SeDebugPrivilege	2832	killisrael.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe

description	pid	process	target process
PID 2412 wrote to memory of 1304	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	schtasks.exe
PID 2412 wrote to memory of 1304	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	schtasks.exe
PID 2412 wrote to memory of 1304	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	schtasks.exe
PID 2412 wrote to memory of 1304	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	schtasks.exe
PID 2412 wrote to memory of 2832	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	killisrael.exe
PID 2412 wrote to memory of 2832	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	killisrael.exe
PID 2412 wrote to memory of 2832	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	killisrael.exe
PID 2412 wrote to memory of 2832	2412	6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe	killisrael.exe

C:\Users\Admin\AppData\Local\Temp\6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\killisrael.exe'"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Users\Admin\AppData\Local\Temp\killisrael.exe
"C:\Users\Admin\AppData\Local\Temp\killisrael.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\killisrael.exe
Filesize
166KB

MD5
6031245730bb86ee6c6787883d814de8

SHA1
092b50c20b455e17dd8bb45ad920882b4c3d8bde

SHA256
dd209b50e0feb6e778d19457d6b8f5f4eeb3d0aec567521cc6688973521d693d

SHA512
410d603df8f86936ce1443dc6e115b1124e61ee17afad5abd3f798cb745af17a1b5be583e908d7039f1e6e027a286beb3980365eeb665c2e8736934b390211d9

Download Submit
memory/2412-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/2412-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2412-2-0x00000000044F0000-0x000000000450C000-memory.dmp

Filesize
112KB

Download
memory/2412-3-0x0000000004510000-0x0000000004540000-memory.dmp

Filesize
192KB

Download
memory/2412-4-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2412-14-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2832-12-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2832-13-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2832-15-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2832-16-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads