limerat | 61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1

General

Target

f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
Size

111KB
MD5

f41c8229b3c54c3ff51191372d9cb790
SHA1

c4d57e6f2b94060a94c4f84863a597c2ef58651d
SHA256

61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1
SHA512

df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11
SSDEEP

1536:eR+7RKzXHFJOgDmUiApuj9bcqRaJB2d+JutQNGKZPPXveSxIYjT:eRSKzXlkgC7AKgJSCAY/

Score

10^/10

limerat vjw0rm discovery execution persistence rat trojan worm

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/G9wX4J5m
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Limerat family
limerat
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	New-Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
4296	New-Client.exe
4236	player.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JXSCMTN53F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	pastebin.com
24	pastebin.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New-Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	player.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1856	schtasks.exe
1000	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	player.exe
Token: SeDebugPrivilege	4236	player.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4940	2872	wscript.exe	83
PID 2872 wrote to memory of 4940	2872	wscript.exe	83
PID 2872 wrote to memory of 1856	2872	wscript.exe	85
PID 2872 wrote to memory of 1856	2872	wscript.exe	85
PID 4940 wrote to memory of 4296	4940	wscript.exe	87
PID 4940 wrote to memory of 4296	4940	wscript.exe	87
PID 4940 wrote to memory of 4296	4940	wscript.exe	87
PID 4296 wrote to memory of 1000	4296	New-Client.exe	89
PID 4296 wrote to memory of 1000	4296	New-Client.exe	89
PID 4296 wrote to memory of 1000	4296	New-Client.exe	89
PID 4296 wrote to memory of 4236	4296	New-Client.exe	91
PID 4296 wrote to memory of 4236	4296	New-Client.exe	91
PID 4296 wrote to memory of 4236	4296	New-Client.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Roaming\New-Client.exe
    "C:\Users\Admin\AppData\Roaming\New-Client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1000
  - - C:\Users\Admin\AppData\Roaming\player.exe
      "C:\Users\Admin\AppData\Roaming\player.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\New-Client.exe

Filesize
28KB

MD5
1ad564a6ca1520e8886faffc4e0ff1d4

SHA1
7d3b61daef1afed73838351dbf788448cf88d031

SHA256
2c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4

SHA512
b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441

Download Submit
C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js

Filesize
55KB

MD5
676c61e12789321127ee39d4f6040e6e

SHA1
d28eb6214cc3b5659d758ac1f64c7ad0d9a1d0f5

SHA256
c2ac77ca98d95ffa6ad11691c395bf22c564ab87f8dfad3211533a215b89d28b

SHA512
439218663821587f1727d7b833dae0991b75ae9f0e5a0761c72984758b3f1750fdca7242f1f8d9626561c3eeab826892d190112b901b1f632df75c820f67e5f8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads