Analysis
-
max time kernel
154s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe
-
Size
306KB
-
MD5
6cdbe9944dc0f99bd89379b5bb715ddc
-
SHA1
75cc7159ba568fb936354473c70c338e37f1a55c
-
SHA256
66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f
-
SHA512
fe42b09547596be9c621abb27b9c930046d2c56f7d9a924560f3c65142ca4ceaef3c0a110e2fa19bbb4c9e7a02e712edb49c4796dafa4dac23f9bf8c9cb1e6ed
Score
10/10
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" RezohSkypeToolV2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\442597\\RezohSkypeToolV2.exe\"" RezohSkypeToolV2.exe -
Executes dropped EXE 2 IoCs
pid Process 976 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe -
Loads dropped DLL 3 IoCs
pid Process 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 976 RezohSkypeToolV2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\RezohSkypeToolV2 = "\"C:\\ProgramData\\442597\\RezohSkypeToolV2.exe\"" RezohSkypeToolV2.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe RezohSkypeToolV2.exe File created C:\Windows\SysWOW64\clientsvr.exe RezohSkypeToolV2.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1540 set thread context of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 976 set thread context of 1044 976 RezohSkypeToolV2.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 976 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe 1044 RezohSkypeToolV2.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe Token: SeDebugPrivilege 976 RezohSkypeToolV2.exe Token: SeDebugPrivilege 1044 RezohSkypeToolV2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 RezohSkypeToolV2.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 1540 wrote to memory of 656 1540 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 27 PID 656 wrote to memory of 976 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 29 PID 656 wrote to memory of 976 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 29 PID 656 wrote to memory of 976 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 29 PID 656 wrote to memory of 976 656 66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe 29 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 976 wrote to memory of 1044 976 RezohSkypeToolV2.exe 30 PID 1044 wrote to memory of 656 1044 RezohSkypeToolV2.exe 27 PID 1044 wrote to memory of 656 1044 RezohSkypeToolV2.exe 27 PID 1044 wrote to memory of 656 1044 RezohSkypeToolV2.exe 27 PID 1044 wrote to memory of 656 1044 RezohSkypeToolV2.exe 27 PID 1044 wrote to memory of 656 1044 RezohSkypeToolV2.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe"C:\Users\Admin\AppData\Local\Temp\66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe"C:\Users\Admin\AppData\Local\Temp\66fcf7b770ca9f62f18c4c30e3d4597b9ba86091d737abb4f83acfd31ed81f4f.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:656 -
C:\ProgramData\442597\RezohSkypeToolV2.exe"C:\ProgramData\442597\RezohSkypeToolV2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\ProgramData\442597\RezohSkypeToolV2.exe"C:\ProgramData\442597\RezohSkypeToolV2.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
-
-
-