limerat | 078f237e95224e906f03b4920f9b42e82ce461f7ea86505eaa45f4de26aa4f65

General

Target

HWID Changer by SILENQER/compreg/config.exe
Size

1.1MB
MD5

fa841009c24985df81baae7d44f3e3ee
SHA1

aebdcf268615a1de7f330bed68edd3a3a86e244e
SHA256

793601e28e74f3850b8ea2ae83f87d34ad6d469e2ff334b8987f414aab8577b4
SHA512

1d58d842d4572029aa2887a289edf19e8e33e2b5e3d387fcab4470535cd4cfb45b44d1f8bae8798ffd1a45e089510b52b9925402cb5648e5a10889705cfd41f9
SSDEEP

24576:eR+cl7X1BRnI6hmebbe1dEt8QR04TG8Ev4P0D6epjKXwzG3X8MHf3VDTXK:a+clb1BRntmeXKd9Q3G85sDzpOXoE8x

Score

10^/10

limerat discovery rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Remcos
antivm
false
c2_url
https://pastebin.com/raw/fBSseKkF
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/fBSseKkF
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Limerat family
limerat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

config.exeMSbuild.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	config.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	MSbuild.exe

Executes dropped EXE 4 IoCs

Processes:

MSbuild.exeHWID Changer.exeMSbuild.exeMSbuild.exe

pid	Process
2788	MSbuild.exe
4192	HWID Changer.exe
556	MSbuild.exe
3356	MSbuild.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
34	pastebin.com
35	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

MSbuild.exe

description	pid	Process	procid_target
PID 2788 set thread context of 3356	2788	MSbuild.exe	107

Drops file in Program Files directory 6 IoCs

Processes:

config.exe

description	ioc	Process
File opened for modification	C:\Program Files\MSextract	config.exe
File created	C:\Program Files\MSextract\__tmp_rar_sfx_access_check_240620078	config.exe
File created	C:\Program Files\MSextract\HWID Changer.exe	config.exe
File opened for modification	C:\Program Files\MSextract\HWID Changer.exe	config.exe
File created	C:\Program Files\MSextract\MSbuild.exe	config.exe
File opened for modification	C:\Program Files\MSextract\MSbuild.exe	config.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSbuild.exeHWID Changer.exeMSbuild.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HWID Changer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
1100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

MSbuild.exe

pid	Process
2788	MSbuild.exe
2788	MSbuild.exe
2788	MSbuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MSbuild.exeMSbuild.exe

description	pid	Process
Token: SeDebugPrivilege	2788	MSbuild.exe
Token: SeDebugPrivilege	3356	MSbuild.exe
Token: SeDebugPrivilege	3356	MSbuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

config.exeMSbuild.exe

description	pid	Process	procid_target
PID 4024 wrote to memory of 2788	4024	config.exe	85
PID 4024 wrote to memory of 2788	4024	config.exe	85
PID 4024 wrote to memory of 2788	4024	config.exe	85
PID 4024 wrote to memory of 4192	4024	config.exe	87
PID 4024 wrote to memory of 4192	4024	config.exe	87
PID 4024 wrote to memory of 4192	4024	config.exe	87
PID 2788 wrote to memory of 1100	2788	MSbuild.exe	104
PID 2788 wrote to memory of 1100	2788	MSbuild.exe	104
PID 2788 wrote to memory of 1100	2788	MSbuild.exe	104
PID 2788 wrote to memory of 556	2788	MSbuild.exe	106
PID 2788 wrote to memory of 556	2788	MSbuild.exe	106
PID 2788 wrote to memory of 556	2788	MSbuild.exe	106
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107
PID 2788 wrote to memory of 3356	2788	MSbuild.exe	107

C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe
"C:\Users\Admin\AppData\Local\Temp\HWID Changer by SILENQER\compreg\config.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files\MSextract\MSbuild.exe
  "C:\Program Files\MSextract\MSbuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcjPCP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1930.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1100
- - C:\Program Files\MSextract\MSbuild.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    PID:556
- - C:\Program Files\MSextract\MSbuild.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Program Files\MSextract\HWID Changer.exe
  "C:\Program Files\MSextract\HWID Changer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSextract\HWID Changer.exe

Filesize
885KB

MD5
43c147d6afafbf546ac6fdfe4ae049c9

SHA1
faf2ced44d5794372c0c42b32d47f68580e18dbf

SHA256
9ecccf1c26e43ca90cf997dc0ecd3e1ef6f3405a8bc46583725bc7e1d27fd235

SHA512
249b1c7130c3dd9c315c2eeafdb2748d0c97b9cd710056b36d983785e01185e308ef2a1c80d0c1d7adce05557b6b70ac7dcf581be7975836651ef98673fa7bb8

Download Submit
C:\Program Files\MSextract\MSbuild.exe

Filesize
858KB

MD5
a71cd5886cca33a25f832a1ed37bc4af

SHA1
7bacf2f5f80c03a298528106a34db71951a1e94e

SHA256
8c5b2aa9fc23e7e50d09bb41c9729efd821e6094a0477a65054ff20938723d88

SHA512
eb672552875d873dd2e5518ac022e99e0a8531a52f9d67f2dbaf09b66809483a7881fbf46472ed9f38df9bb46bd89016a53220fbf38149a2c507efda0a66be03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSbuild.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1930.tmp

Filesize
1KB

MD5
6e1034e96e164f3988d7e2d11fd40078

SHA1
7c7faa4c56e12a1420703a7dae2b7996c362851c

SHA256
60707984e0bce53563e0c562c906d445c3e8da9a7c1980d64553de7335044c5c

SHA512
f5a1835d90b20f5887d745a4dbf0d5c9a26bb9e0c829b4370bd20eb4092fe9825048564d28321dadac3b09134aa378d684fd9f80a67c9965f12f4a2389074393

Download Submit
memory/2788-31-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/2788-38-0x00000000071B0000-0x0000000007234000-memory.dmp

Filesize
528KB

Download
memory/2788-48-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/2788-26-0x0000000000D30000-0x0000000000E0C000-memory.dmp

Filesize
880KB

Download
memory/2788-27-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/2788-33-0x0000000006CE0000-0x0000000006D7C000-memory.dmp

Filesize
624KB

Download
memory/2788-34-0x0000000006CB0000-0x0000000006CC4000-memory.dmp

Filesize
80KB

Download
memory/2788-39-0x000000000AB30000-0x000000000AB60000-memory.dmp

Filesize
192KB

Download
memory/2788-36-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/3356-49-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/3356-44-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4192-32-0x0000000005AE0000-0x0000000005AEA000-memory.dmp

Filesize
40KB

Download
memory/4192-37-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-35-0x000000007513E000-0x000000007513F000-memory.dmp

Filesize
4KB

Download
memory/4192-25-0x0000000000F90000-0x0000000001074000-memory.dmp

Filesize
912KB

Download
memory/4192-30-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-29-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Filesize
584KB

Download
memory/4192-24-0x000000007513E000-0x000000007513F000-memory.dmp

Filesize
4KB

Download
memory/4192-28-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads