limerat | d6e501f0804b1fd3b62a32366a9845a7fd010a0434dac804ffcec95fa67267a3

General

Target

f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
Size

1.7MB
MD5

f8c656d9ff2a5c0b21769b4e1033bde7
SHA1

c2e991aeb28ebf42c1f2dbfcbd4df6e2320ab3d2
SHA256

d6e501f0804b1fd3b62a32366a9845a7fd010a0434dac804ffcec95fa67267a3
SHA512

098b1ce3e5d95d318caccd1ce77be80484f7cef1aae807e3815f32fa2d49f74be7085c2f716187c7d074ea9e239ebfa1e5817b436c9c92e546bfc0e7560096ed
SSDEEP

6144:gCDZnh3bt0kqEZKjwF+IRTA/AntEymXZoelvYihONWKkIAL5wMYDkdIihf/FS/6P:gC1n395ElLNHwWKJAL5D3hna6

Score

10^/10

limerat defense_evasion discovery rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
1205
antivm
false
c2_url
https://pastebin.com/raw/iRjhpqQL
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/iRjhpqQL
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfgdfge.exe.lnk	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4544	svhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
16	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 116 set thread context of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\defsghg\dfgdfge.exe:Zone.Identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3608	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\defsghg\dfgdfge.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
Token: 33	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
Token: SeDebugPrivilege	4544	svhost.exe
Token: SeDebugPrivilege	4544	svhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3624	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	82
PID 116 wrote to memory of 3624	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	82
PID 116 wrote to memory of 3624	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	82
PID 116 wrote to memory of 3612	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	84
PID 116 wrote to memory of 3612	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	84
PID 116 wrote to memory of 3612	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	84
PID 116 wrote to memory of 1172	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	86
PID 116 wrote to memory of 1172	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	86
PID 116 wrote to memory of 1172	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	86
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 4544	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	88
PID 116 wrote to memory of 836	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	89
PID 116 wrote to memory of 836	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	89
PID 116 wrote to memory of 836	116	f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe	89
PID 836 wrote to memory of 3608	836	cmd.exe	91
PID 836 wrote to memory of 3608	836	cmd.exe	91
PID 836 wrote to memory of 3608	836	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/f8c656d9ff2a5c0b21769b4e1033bde7_JaffaCakes118.exe" "%appdata%\defsghg\dfgdfge.exe" /Y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\defsghg\dfgdfge.exe:Zone.Identifier
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:3612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\defsghg\dfgdfge.exe.jpg" dfgdfge.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\defsghg\dfgdfge.exe.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
C:\Users\Admin\AppData\Roaming\defsghg\dfgdfge.exe

Filesize
1.7MB

MD5
f8c656d9ff2a5c0b21769b4e1033bde7

SHA1
c2e991aeb28ebf42c1f2dbfcbd4df6e2320ab3d2

SHA256
d6e501f0804b1fd3b62a32366a9845a7fd010a0434dac804ffcec95fa67267a3

SHA512
098b1ce3e5d95d318caccd1ce77be80484f7cef1aae807e3815f32fa2d49f74be7085c2f716187c7d074ea9e239ebfa1e5817b436c9c92e546bfc0e7560096ed

Download Submit
C:\Users\Admin\AppData\Roaming\defsghg\dfgdfge.exe.bat

Filesize
204B

MD5
e2bddbe36b71e23b16f1721da8f3564c

SHA1
b01f1c913bb94b8ba068732065d5da347bf143bc

SHA256
8b0219b83d6a50727a4acf2ccf53a04cfd348577d90c2489cf9b0d082d43872d

SHA512
c07d35abdc8fd3e366383ad7c92d4dc6adebbd0c2ecf0dd7cd5981f3cf72e6d9e6a9cf00719eb7e016dd0dd677ca5794295a2da1a74a8436b092f737db78868b

Download Submit
memory/116-4-0x0000000005C10000-0x0000000005CAC000-memory.dmp

Filesize
624KB

Download
memory/116-24-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/116-6-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/116-5-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Filesize
304KB

Download
memory/116-3-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/116-2-0x00000000061C0000-0x0000000006764000-memory.dmp

Filesize
5.6MB

Download
memory/116-28-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/116-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/116-1-0x0000000000F60000-0x00000000010CE000-memory.dmp

Filesize
1.4MB

Download
memory/116-25-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4544-18-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4544-23-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4544-22-0x00000000051A0000-0x0000000005206000-memory.dmp

Filesize
408KB

Download
memory/4544-26-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4544-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4544-29-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads