limerat | 078f237e95224e906f03b4920f9b42e82ce461f7ea86505eaa45f4de26aa4f65

General

Target

HWID Changer by SILENQER/compreg/config.exe
Size

1.1MB
MD5

fa841009c24985df81baae7d44f3e3ee
SHA1

aebdcf268615a1de7f330bed68edd3a3a86e244e
SHA256

793601e28e74f3850b8ea2ae83f87d34ad6d469e2ff334b8987f414aab8577b4
SHA512

1d58d842d4572029aa2887a289edf19e8e33e2b5e3d387fcab4470535cd4cfb45b44d1f8bae8798ffd1a45e089510b52b9925402cb5648e5a10889705cfd41f9
SSDEEP

24576:eR+cl7X1BRnI6hmebbe1dEt8QR04TG8Ev4P0D6epjKXwzG3X8MHf3VDTXK:a+clb1BRntmeXKd9Q3G85sDzpOXoE8x

Score

10^/10

limerat discovery rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Remcos
antivm
false
c2_url
https://pastebin.com/raw/fBSseKkF
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/fBSseKkF
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Limerat family
limerat

Executes dropped EXE 3 IoCs

pid	Process
2776	MSbuild.exe
2780	HWID Changer.exe
2860	MSbuild.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 2860	2776	MSbuild.exe	34

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\MSextract\HWID Changer.exe	config.exe
File opened for modification	C:\Program Files\MSextract\HWID Changer.exe	config.exe
File created	C:\Program Files\MSextract\MSbuild.exe	config.exe
File opened for modification	C:\Program Files\MSextract\MSbuild.exe	config.exe
File opened for modification	C:\Program Files\MSextract	config.exe
File created	C:\Program Files\MSextract\__tmp_rar_sfx_access_check_259452953	config.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HWID Changer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSbuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	MSbuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	MSbuild.exe
Token: SeDebugPrivilege	2860	MSbuild.exe
Token: SeDebugPrivilege	2860	MSbuild.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2776	2008	config.exe	30
PID 2008 wrote to memory of 2776	2008	config.exe	30
PID 2008 wrote to memory of 2776	2008	config.exe	30
PID 2008 wrote to memory of 2776	2008	config.exe	30
PID 2008 wrote to memory of 2780	2008	config.exe	31
PID 2008 wrote to memory of 2780	2008	config.exe	31
PID 2008 wrote to memory of 2780	2008	config.exe	31
PID 2008 wrote to memory of 2780	2008	config.exe	31
PID 2776 wrote to memory of 2296	2776	MSbuild.exe	32
PID 2776 wrote to memory of 2296	2776	MSbuild.exe	32
PID 2776 wrote to memory of 2296	2776	MSbuild.exe	32
PID 2776 wrote to memory of 2296	2776	MSbuild.exe	32
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34
PID 2776 wrote to memory of 2860	2776	MSbuild.exe	34

C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe
"C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files\MSextract\MSbuild.exe
  "C:\Program Files\MSextract\MSbuild.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcjPCP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7243.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2296
- - C:\Program Files\MSextract\MSbuild.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\Program Files\MSextract\HWID Changer.exe
  "C:\Program Files\MSextract\HWID Changer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSextract\HWID Changer.exe

Filesize
885KB

MD5
43c147d6afafbf546ac6fdfe4ae049c9

SHA1
faf2ced44d5794372c0c42b32d47f68580e18dbf

SHA256
9ecccf1c26e43ca90cf997dc0ecd3e1ef6f3405a8bc46583725bc7e1d27fd235

SHA512
249b1c7130c3dd9c315c2eeafdb2748d0c97b9cd710056b36d983785e01185e308ef2a1c80d0c1d7adce05557b6b70ac7dcf581be7975836651ef98673fa7bb8

Download Submit
C:\Program Files\MSextract\MSbuild.exe

Filesize
858KB

MD5
a71cd5886cca33a25f832a1ed37bc4af

SHA1
7bacf2f5f80c03a298528106a34db71951a1e94e

SHA256
8c5b2aa9fc23e7e50d09bb41c9729efd821e6094a0477a65054ff20938723d88

SHA512
eb672552875d873dd2e5518ac022e99e0a8531a52f9d67f2dbaf09b66809483a7881fbf46472ed9f38df9bb46bd89016a53220fbf38149a2c507efda0a66be03

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7243.tmp

Filesize
1KB

MD5
1b484454a8ee39eab84beff4bfd2866c

SHA1
d4dcb042a4c4b6302166f35781199d595972faae

SHA256
99bade0e6562017eba50740569caf8f79068f5f89c042cd91813386fc70e26ab

SHA512
26d55f50606355b92774773a91bfabaf67340d667d553e27b71e120373cd8c46d342930355e2be5e18de2f3bbb1c279f1257617893581f9b996cfd251f060a96

Download Submit
memory/2776-34-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-24-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/2776-51-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-25-0x0000000000D10000-0x0000000000DEC000-memory.dmp

Filesize
880KB

Download
memory/2776-29-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-30-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/2776-31-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/2776-36-0x00000000008C0000-0x00000000008F0000-memory.dmp

Filesize
192KB

Download
memory/2776-35-0x00000000048A0000-0x0000000004924000-memory.dmp

Filesize
528KB

Download
memory/2780-28-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-33-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-32-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-27-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-26-0x0000000000E50000-0x0000000000F34000-memory.dmp

Filesize
912KB

Download
memory/2860-40-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2860-42-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2860-45-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2860-47-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2860-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-50-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2860-49-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads