limerat | cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js
Size

110KB
MD5

166d32ce24cda5d9d5598fa9701fbff7
SHA1

a34f8175087f31c13ec473753aef9b693f2085c2
SHA256

cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38
SHA512

76d982a58335f92a4a057fbaf669f2b76dc54f60e5ccfc7a86050afdfc2a417b3f8971eee176c991c09084dc471b58875cbaaabcd6358ef24bedf48a18a7a231
SSDEEP

1536:0R+7RKzXHFJOgDmUiApuj9bcqRaJB2d+JutQNGKZPPXveSxIYjKzn:0RSKzXlkgC7AKgJSCAYmzn

Score

10^/10

limerat vjw0rm discovery execution persistence rat trojan worm

Malware Config

Extracted

Family

limerat

Wallets

1Cs8MjxkXtYwkDKypg8i1Vj5nzhANpgC6y

Attributes

aes_key
2249
antivm
false
c2_url
https://pastebin.com/raw/G9wX4J5m
delay
8
download_payload
false
install
true
install_name
player.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
false

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/G9wX4J5m
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Limerat family
limerat
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1668	New-Client.exe
1792	player.exe

Loads dropped DLL 2 IoCs

pid	Process
1668	New-Client.exe
1668	New-Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\JXSCMTN53F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 53 IoCs

Web Service

T1102

flow	ioc
44	pastebin.com
56	pastebin.com
11	pastebin.com
47	pastebin.com
64	pastebin.com
7	pastebin.com
10	pastebin.com
54	pastebin.com
13	pastebin.com
23	pastebin.com
15	pastebin.com
25	pastebin.com
38	pastebin.com
60	pastebin.com
63	pastebin.com
53	pastebin.com
57	pastebin.com
30	pastebin.com
24	pastebin.com
49	pastebin.com
17	pastebin.com
19	pastebin.com
42	pastebin.com
46	pastebin.com
55	pastebin.com
58	pastebin.com
8	pastebin.com
35	pastebin.com
29	pastebin.com
36	pastebin.com
41	pastebin.com
45	pastebin.com
6	pastebin.com
18	pastebin.com
48	pastebin.com
28	pastebin.com
39	pastebin.com
27	pastebin.com
34	pastebin.com
51	pastebin.com
9	pastebin.com
14	pastebin.com
26	pastebin.com
33	pastebin.com
12	pastebin.com
32	pastebin.com
37	pastebin.com
43	pastebin.com
50	pastebin.com
61	pastebin.com
59	pastebin.com
20	pastebin.com
21	pastebin.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New-Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	player.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2808	schtasks.exe
2992	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	player.exe
Token: SeDebugPrivilege	1792	player.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2020	540	wscript.exe	31
PID 540 wrote to memory of 2020	540	wscript.exe	31
PID 540 wrote to memory of 2020	540	wscript.exe	31
PID 2020 wrote to memory of 1668	2020	wscript.exe	33
PID 2020 wrote to memory of 1668	2020	wscript.exe	33
PID 2020 wrote to memory of 1668	2020	wscript.exe	33
PID 2020 wrote to memory of 1668	2020	wscript.exe	33
PID 540 wrote to memory of 2808	540	wscript.exe	34
PID 540 wrote to memory of 2808	540	wscript.exe	34
PID 540 wrote to memory of 2808	540	wscript.exe	34
PID 1668 wrote to memory of 2992	1668	New-Client.exe	37
PID 1668 wrote to memory of 2992	1668	New-Client.exe	37
PID 1668 wrote to memory of 2992	1668	New-Client.exe	37
PID 1668 wrote to memory of 2992	1668	New-Client.exe	37
PID 1668 wrote to memory of 1792	1668	New-Client.exe	39
PID 1668 wrote to memory of 1792	1668	New-Client.exe	39
PID 1668 wrote to memory of 1792	1668	New-Client.exe	39
PID 1668 wrote to memory of 1792	1668	New-Client.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Roaming\New-Client.exe
    "C:\Users\Admin\AppData\Roaming\New-Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2992
  - - C:\Users\Admin\AppData\Roaming\player.exe
      "C:\Users\Admin\AppData\Roaming\player.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1792
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\New-Client.exe

Filesize
28KB

MD5
1ad564a6ca1520e8886faffc4e0ff1d4

SHA1
7d3b61daef1afed73838351dbf788448cf88d031

SHA256
2c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4

SHA512
b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441

Download Submit
C:\Users\Admin\AppData\Roaming\jXZTZBjYZp.js

Filesize
55KB

MD5
676c61e12789321127ee39d4f6040e6e

SHA1
d28eb6214cc3b5659d758ac1f64c7ad0d9a1d0f5

SHA256
c2ac77ca98d95ffa6ad11691c395bf22c564ab87f8dfad3211533a215b89d28b

SHA512
439218663821587f1727d7b833dae0991b75ae9f0e5a0761c72984758b3f1750fdca7242f1f8d9626561c3eeab826892d190112b901b1f632df75c820f67e5f8

Download Submit
memory/1668-10-0x0000000074261000-0x0000000074262000-memory.dmp

Filesize
4KB

Download
memory/1668-12-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-13-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-14-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-25-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads