Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
899s -
max time network
900s -
platform
windows11-21h2_x64 -
resource
win11-20250314-en -
resource tags
arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/03/2025, 04:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/NYAN-x-CAT/Lime-RAT/releases/download/v0.1.9.2/Compiled.zip
Resource
win11-20250314-en
General
-
Target
https://github.com/NYAN-x-CAT/Lime-RAT/releases/download/v0.1.9.2/Compiled.zip
Malware Config
Extracted
limerat
-
aes_key
3314
-
antivm
true
-
c2_url
https://pastebin.com/raw/DDTVwwbu
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Eulen.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
Limerat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4004 netsh.exe -
Executes dropped EXE 3 IoCs
pid Process 3408 New-Client.exe 3588 Eulen.exe 4020 New-Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 15 pastebin.com 23 pastebin.com 1 pastebin.com 11 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 checkip.dyndns.org -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\DebugComplete.exe OpenWith.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New-Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eulen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New-Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ilasm.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133872626400031939" chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 63031f00e902d5dfa323db02040000000000d70200003153505305d5cdd59c2e1b10939708002b2cf9ae0b02000012000000004100750074006f004c006900730074000000420000001e000000700072006f007000340032003900340039003600370032003900350000000000c3010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000bb0014001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000008c003100000000006e5a2d7a110050524f4752417e310000740009000400efbec5525961785a80202e0000003f0000000000010000000000000000004a00000000009c3cb600500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001f00530065006100720063006800200052006500730075006c0074007300200069006e002000500072006f006700720061006d002000460069006c006500730000000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d00650000001400000035dfb1bb0b0000007700000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f00000021000000530065006100720063006800200052006500730075006c0074007300200069006e002000500072006f006700720061006d002000460069006c006500730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe00000020000000000000000000000000000000000000000000000000010000000f032a0000001900efbe1e1ade7f318ba54993b86be14cfa49436f73bebdf5342948abe8b550e65146c40f030000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 LimeRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "4" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\縀䆁 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" LimeRAT.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU LimeRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\.config\ = "config_auto_file" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 5a00310000000000785aa3201000436f6d70696c65640000420009000400efbe785a8720785aa3202e00000053b3020000001c000000000000000000000000000000b9d0350043006f006d00700069006c0065006400000018000000 LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" LimeRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" LimeRAT.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\Mode = "8" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell LimeRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8 LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202 LimeRAT.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\LogicalViewMode = "5" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" LimeRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Downloads" LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\config_auto_file\shell\Read\command OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "7" LimeRAT.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" LimeRAT.exe Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Compiled.zip:Zone.Identifier chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5948 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5884 chrome.exe 5884 chrome.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5884 chrome.exe 5884 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2872 OpenWith.exe 1068 OpenWith.exe 5044 LimeRAT.exe 2340 LimeRAT.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe Token: SeShutdownPrivilege 5884 chrome.exe Token: SeCreatePagefilePrivilege 5884 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5044 LimeRAT.exe 2340 LimeRAT.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5884 chrome.exe 5044 LimeRAT.exe 2340 LimeRAT.exe -
Suspicious use of SetWindowsHookEx 36 IoCs
pid Process 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 2872 OpenWith.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 5304 AcroRd32.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 1068 OpenWith.exe 2340 LimeRAT.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5884 wrote to memory of 5876 5884 chrome.exe 78 PID 5884 wrote to memory of 5876 5884 chrome.exe 78 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 760 5884 chrome.exe 79 PID 5884 wrote to memory of 3076 5884 chrome.exe 80 PID 5884 wrote to memory of 3076 5884 chrome.exe 80 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81 PID 5884 wrote to memory of 3424 5884 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/NYAN-x-CAT/Lime-RAT/releases/download/v0.1.9.2/Compiled.zip1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb15adcf8,0x7ffdb15add04,0x7ffdb15add102⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1892,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1884 /prefetch:22⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2180,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2216 /prefetch:112⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2480 /prefetch:132⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4180,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4228 /prefetch:92⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5296 /prefetch:142⤵PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4700,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5172 /prefetch:142⤵
- NTFS ADS
PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5372,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5148 /prefetch:142⤵PID:1912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5732 /prefetch:142⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4780,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5700 /prefetch:142⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3232,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5552 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5136,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3312 /prefetch:142⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:3600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4772
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5444
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe.config"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5304
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1068
-
C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5044 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="LimeRAT" dir=in action=allow program="C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe" enable=yes2⤵PID:1028
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="LimeRAT" dir=in action=allow program="C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4004
-
-
-
C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe "C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.il" /out="C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.exe"3⤵PID:4728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe "C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.il" /out="C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4864
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C81⤵PID:3228
-
C:\Users\Admin\Downloads\New-Client.exe"C:\Users\Admin\Downloads\New-Client.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Eulen.exe'"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5948
-
-
C:\Users\Admin\AppData\Local\Temp\Eulen.exe"C:\Users\Admin\AppData\Local\Temp\Eulen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3588
-
-
C:\Users\Admin\Downloads\New-Client.exe"C:\Users\Admin\Downloads\New-Client.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4020
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD570f37ff50c8901a32f5c724f3a06d07e
SHA1cdc3fa0f73f06fb4d578ec604cc7c95e51cfb1ca
SHA256099e35b23959269d3b0e225bb016786873dba3f54e81aa65c910f1c2663a30cb
SHA512029f26484b11328bbe0421d0b9023e58d438c799da08e28846e0b9811d226fba15dd80f33a272cf912268fd8c92c355e794864ae6268479d57f672fdb159de58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2aa017a1-a306-4112-bc0a-0a465f7aac3a.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD54798fc16f272b81103fa20955c667d97
SHA12fa2056417d66ad7bdc78b5f5296713879b5bffa
SHA25644a837f797260b5e01228276b9cb189ac5c0a551597da834f9824a7142a144cd
SHA512ba52f5cc0506f9ce436e44bbf4f8ee4951119392bed2caa95a7dcefe59ed3815f0f0fe1c7faa687fa45e5f7bee0b1c44f7e0b98c2cbdfe6c095e588894e675ba
-
Filesize
2KB
MD5fb76cc1fb2d83410d0cc8b97a90de278
SHA172a3fd2a795d04ef7bce031a3caf70f5fd37ea47
SHA2564ca4802cd1a4736d9917dfe5b52534f1528286c1a22e0cf02d3db8c19585b714
SHA512a3f99417191f593a2883e460f4e4898de638c62b7f5581502e5d4a429ec9863e58fef18b7bbb174dae46f23a0c583d78bf4aa26c3ec7d263d18b5163a180da5f
-
Filesize
2KB
MD5e692fd78163acf0dd6cec5bd39f50eab
SHA19fa25f13111166eefcaf231579f4dd3e4a1b76c8
SHA2563f7cee87cee710545abeb693eca5d12118ec59a7f92125e86d9b204c8182d7dd
SHA5120e5ea15a547bbe5ce502f2f4208b2a4e13fb8a362b241c6054d3e9f5c7b3404539af533bb479cfd7231de631cd79708979ac4b880a43990fbb5274de091b0b64
-
Filesize
523B
MD50dbed948a02c584b3d6ab1b86b1fa24c
SHA115756ce7ee20f27d9a24f645970645f3ff1b9cfa
SHA256be0fd57e5e210cc9519e3bcb35817bfc9a280bde52eaba18915f9955f03e21e3
SHA512cd260db5a062b9e14b19a790d16fefab0ae68d803d8469b6f5b3ffeed3f31d2ee732f0875398134392cfd38003917ff9e9052dbbf03c585718b7507c8835ce17
-
Filesize
10KB
MD5a40a5cb2a7a6de2562fa3b659a0b9180
SHA154a8971a28b3534dc963b18faf04b96c390620e3
SHA2567edec49afa4a62f062efa510b11ddfc144d377d36725aa41e952522536cdcf56
SHA512540716491ac030dcda3960749ebfe86d05589c76544198dcb26a1fc2392792cbf369cd2ae041fce296b42c6436c27a6442f44fd685921778fb0fa5f8c0305bb3
-
Filesize
15KB
MD50c4ee74392bcb9c2651fb89da5d6ea38
SHA13b0c059f0763113bc1f02ff5dcbc7ab421b9bb30
SHA256271186f51c93e49b8e397d63570f77ed64355ad873c825457f56c4be696da869
SHA5120c69717b1882b08f112a904faf5b582497a6ba83dceeb00e15c8522c1557dc55e25ee27713984c27e49a24c9d84606c6cb4edd41168ee16587e07a3402257080
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5848df3de79064e96a55e9d2306a1e483
SHA168b2adf31add077a933385fbd389a8bc6206c29a
SHA256479bbbf222e95ad378b260cfd03f8320c9e91d72ed8e92809256e925c4a3fb79
SHA512f5481245ff6239524f0eb545829a663e4b4e7260f434cf280949868ec6ae3544d5ec30b143668eb17854cfecac67e69dc38ac005a1e3f59db95b4f34cfee61b5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c217.TMP
Filesize48B
MD57cc4a384dfbef6805f89c91bdc5209db
SHA12a49929e4b412ef0bc134030dba7b5de2977004a
SHA256304f70551892eb6ab2cb2fb67c3084ecee539f3747a2fcdc0fde2d1db9d846b5
SHA5129de11bc0264dbc878ed9b5836049b7fd2ebb57862da2e832fa81f1d37d2a861fa3cea67532c437a0f4e992ccb534af8de43ac9d5e04bc164085240a122d23353
-
Filesize
81KB
MD57ef75ab7fdd37539d7b38127a4c6c30a
SHA181085eb75a2a8f454e731b5402688e4646f0dca5
SHA256d134afa9709b45782a06cc6859ff7a9da8199482a9c19a02535d24644ad067d5
SHA512f77063be9541d29907077f4f51eca0380dab7d9804e59611ee4a552368108c12cc91a89792490e6cee336849118d99a5a811575760ecca9ca5e004749a1ee23b
-
Filesize
80KB
MD5e2e54a79be168abeee771c6153efe3b8
SHA168186c4ed522f40257b11d0b078901ba29842790
SHA256b247f1410b95e0846d4d29dbf4866c80eff16ce7fc8dd6b529c367c75d92cf48
SHA5126ec04abe12e2a14550e827e8848739f8553103b6db4a57df14ac7c19aca5a25ce1112439e571dc70640a59d8a7bca2a86d35ce995830832dadf15802dda2ff65
-
Filesize
81KB
MD5ed585ee73268aea75818759047cfc336
SHA11ee3685b0c894ae331c8113aeaf9b0ba40da2028
SHA256735108d33d92d63db65f8fad8150c9fe34af67270d88c05c8b6ab0d802cf93e7
SHA512d80324690883185a901328ad182ad52fe3f490b83038e4218437c86c248baf2ce225262d6fea7755e6ce90298e001b163bfbf8a989d9d6ccafaeeecb4a68121e
-
Filesize
81KB
MD55b62492244a3250818bcb8771a77e173
SHA13c5b46514ccf80e88229778f75da85892ebe5c1c
SHA2567809e3a407c6ba1eb175c7a907f3d06e481c1caaaaf6d53840d55a587673c7ae
SHA512078b6de72e5a8da8644c26d29a1960dad37c1ab2475a03303246730ffafb6801438d767043fc9c9507644fca98daea609cf3a5676f274140595f9b2a9aeedb51
-
C:\Users\Admin\AppData\Local\Lime_RAT\LimeRAT.exe_Url_svvmbk54fumvnksdeatxsj5e4flh5yeg\0.1.9.0\user.config
Filesize306B
MD59a990d0ce47fd366948757bf4c78dfbb
SHA14aed5c56a8af149e4ea193ea60f83ecb0bfa41a6
SHA256fc5d08acbf02dc086a8fa4b7703541f17a729b2774de9fdea107c07973617a42
SHA5125a841689c7b49b349e64c679f96f6ab968addc38917bfec6399285e3c303e03392b00c6cf70ad2a94540c2e3cf41555d08d342ce3392372e9d9f1a69b1fc7786
-
C:\Users\Admin\AppData\Local\Lime_RAT\LimeRAT.exe_Url_svvmbk54fumvnksdeatxsj5e4flh5yeg\0.1.9.0\user.config
Filesize1020B
MD5f4692f2aae3348c1173d4d4223325fdb
SHA1fcc2744869d33f467706633a761dc865bb1d7820
SHA256f1234fb933ffe12bf776c89114081b027c652bf8a4f6b2b66d54c517f5eba0c8
SHA5125e95684fc386e2525e301e89bc59033109d936864c85d48a6fa59aa1f6b2b18cca6b6cc3dfbd0d66f5f16c7a64626f26041792113486b48ab423978d21ea04ad
-
Filesize
2KB
MD56aac7e99708ca30e1e6f3b5c0be0a9b0
SHA1b7def50c4f65eeb7aecd8b87bc9310c04b055615
SHA2566ab9d6ecdfb4fadfc5ea114c6109d00bfdf2c2e57e8b8c46a4e569747ac2182f
SHA512ad16af099207a9a7f13882e59b89106024d64f273dd7df51558c9b61cfa7f6b720dd320e825f0368d44f7e9c476b75b83bb1e8bd526a42d7d32017c8169402fb
-
Filesize
709B
MD5cee382b44a0a258c801e5df212da62dd
SHA185bbc4b6608782987db1a61729e62ec4a7e69371
SHA2560bd749db0dc336f89c80dc04a6522df03c13bd3ca7ec1b5a54ab01413b6ad6c1
SHA51241cd658e569f09ab15c46cc716c576f6ef4862fba47547b09a8576ffd05009465973643c0a5a25d0801adc7be6ba6d3ef7d1e62d0b8a1f0823dfe80c17930dd8
-
Filesize
28KB
MD591630de96afaab78fd4c1a3011b9345b
SHA1012978d8a6cbbbfefb14140a51ad9632ecdb2993
SHA256f0ebab369467500c558f8eaced1c4db773148124269f14a39403f0fb95290e2a
SHA512a7b1b95867f7d81b78d33fecec8c572b11a5163a78e3531db72635ae15401ea3293d4eb9255204454e45e56260116c9863268834829e713bf4565c0e0042ae4c
-
Filesize
28KB
MD535591e628915713d4385dfca0921ed39
SHA185c60c2f5465fa6166cc040ca6e6a0e9cc3c7c31
SHA2567ebd3609f49437840f2abd8ce5bf03a8347900ac1cbff157eec32d5602dc8aa3
SHA5129e54d2de604f2a9321031bd1b3b24f133d10b4d2e09fc0fc5f84e7f5ac9026dd574af19d09cf60abf560ff888e58f6edee0b98407b3f08f7ef4c84341ed62854
-
Filesize
5.1MB
MD55aee9b1a15d337d2b4aefe840cc90dd1
SHA111a430b1ad789fef66effaa6a3f79139be0dc66b
SHA25606500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5
SHA512fa344212957dfb65f194fb220814688d748439d7ea921ad33d8c6fe6cf5b6fe04e263ff686efae17556f4a1db47069e295deedc486b8088b4d0af23fb63742c9
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
6B
MD505ef5741f06c59dc5a0badcd711bb1d8
SHA164cae4add164b296e215661f678264315bfb3cfe
SHA2565003b0292f6a7070e163c9a676fde208ea4a5e9fe9692141fe7f870d0cc47ef8
SHA512365a342a5f09496a354284041bf81f55f073eb53dcacf575d70f29e19ad5faabf0807299e490d7d6de25cb8bb68fede041d214c3c0b9b61ec76fa028fef69fbf
-
Filesize
1.2MB
MD58ef41798df108ce9bd41382c9721b1c9
SHA11e6227635a12039f4d380531b032bf773f0e6de0
SHA256bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
SHA5124c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
-
Filesize
26KB
MD5ab4a190f9bedb408e459ed6430131129
SHA1863931a40f6b1a2dc550e406f34d19ef5289a734
SHA256ce8a36d92991096fee1fe01c517d3ee8efcfcf76da589ef74215edcd231c6a81
SHA512a4f2e58d365c8de3081b5dd16a3508e3daa896eae62db013fccc1b6d9cf184032238c6fb74552a60b55a893ac3e56d1ca59f367dcdce376416090af5b27c91fb
-
Filesize
28KB
MD5dbd23f575813c0405e4898e120dac209
SHA1a5886f7e1ac19500d3233efd54b4c38641d5c617
SHA256e825ec0892f5cae9842a9cc247929227231a02baa0350bd6b61556377cc92e46
SHA5128fdc7262a3c7447ce4c6a1ab8eaf5e1d5ae3fd0d1b32673008a3e0b87bb2e37bcec0541671629dea642a5207ab2498e27ad3180e2658bcfb8710817538dd4c56