Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe
-
Size
313KB
-
MD5
298b03aacf618a8010c3db5b420627ae
-
SHA1
1668cfd05ca70d5acc1174c18d673c529fce402f
-
SHA256
a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347
-
SHA512
6bde1e09d0599c4bc2e9b91880499bc00dec4fe37b32348c66973522116e664fb197c562aaa1e3becdc425a85b01128f298d92cd6f9898c8c059c6c16d13fe45
Score
10/10
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\336293\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 3560 66306821.exe 2324 sysmon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System32 = "\"C:\\ProgramData\\336293\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 powershell.exe 3948 powershell.exe 3948 powershell.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 3560 66306821.exe 3560 66306821.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe 2324 sysmon.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3948 powershell.exe Token: SeDebugPrivilege 2324 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2324 sysmon.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1456 wrote to memory of 3752 1456 a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe 72 PID 1456 wrote to memory of 3752 1456 a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe 72 PID 1456 wrote to memory of 4032 1456 a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe 76 PID 1456 wrote to memory of 4032 1456 a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe 76 PID 4032 wrote to memory of 3948 4032 cmd.exe 78 PID 4032 wrote to memory of 3948 4032 cmd.exe 78 PID 3948 wrote to memory of 3560 3948 powershell.exe 80 PID 3948 wrote to memory of 3560 3948 powershell.exe 80 PID 3948 wrote to memory of 3560 3948 powershell.exe 80 PID 3560 wrote to memory of 2324 3560 66306821.exe 84 PID 3560 wrote to memory of 2324 3560 66306821.exe 84 PID 3560 wrote to memory of 2324 3560 66306821.exe 84 PID 2324 wrote to memory of 3560 2324 sysmon.exe 80 PID 2324 wrote to memory of 3560 2324 sysmon.exe 80 PID 2324 wrote to memory of 3560 2324 sysmon.exe 80 PID 2324 wrote to memory of 3560 2324 sysmon.exe 80 PID 2324 wrote to memory of 3560 2324 sysmon.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe"C:\Users\Admin\AppData\Local\Temp\a2e5e2051fda36150b9c28d797df1ba2917c0c5f4279419efa8902890748b347.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c echo.2⤵PID:3752
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c exec.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File ".\bits.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\66306821\66306821.exe"C:\Users\Admin\AppData\Local\Temp\66306821\66306821.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\ProgramData\336293\sysmon.exe"C:\ProgramData\336293\sysmon.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
-
-
-
-