luminosity | 9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3

General

Target

9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe
Size

912KB
MD5

002edac6795495e55779965de0f1d4ce
SHA1

c60b424c9600934cb004a1d2c3267d0b50c8c2af
SHA256

9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3
SHA512

ad41157ca93e544fba25bf17018d8db3353afdf63ac00ac2c1529bdd782502124ee3767c951680a7dfd68463f4d9b6071ac018fa077ad208a7430a9718f572e9

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity 3 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

pid	Process
1096	schtasks.exe
1500	schtasks.exe
1004	schtasks.exe

Executes dropped EXE 2 IoCs

pid	Process
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
1376	windefend.exe

Loads dropped DLL 2 IoCs

pid	Process
1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe
1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Defender = "cmd /c \"start \"Defender\" \"C:\\Program Files (x86)\\WindowsDefender\\windefend.exe\""	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe
Token: SeDebugPrivilege	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1104	1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe	27
PID 1160 wrote to memory of 1104	1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe	27
PID 1160 wrote to memory of 1104	1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe	27
PID 1160 wrote to memory of 1104	1160	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe	27
PID 1104 wrote to memory of 1096	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	28
PID 1104 wrote to memory of 1096	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	28
PID 1104 wrote to memory of 1096	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	28
PID 1104 wrote to memory of 1096	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	28
PID 1104 wrote to memory of 1500	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	30
PID 1104 wrote to memory of 1500	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	30
PID 1104 wrote to memory of 1500	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	30
PID 1104 wrote to memory of 1500	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	30
PID 1104 wrote to memory of 1004	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	32
PID 1104 wrote to memory of 1004	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	32
PID 1104 wrote to memory of 1004	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	32
PID 1104 wrote to memory of 1004	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	32
PID 1104 wrote to memory of 1940	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	34
PID 1104 wrote to memory of 1940	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	34
PID 1104 wrote to memory of 1940	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	34
PID 1104 wrote to memory of 1940	1104	9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0	34
PID 1696 wrote to memory of 1376	1696	taskeng.exe	37
PID 1696 wrote to memory of 1376	1696	taskeng.exe	37
PID 1696 wrote to memory of 1376	1696	taskeng.exe	37
PID 1696 wrote to memory of 1376	1696	taskeng.exe	37

C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe
"C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0
  "C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Defender" /tr "'C:\Program Files (x86)\WindowsDefender\windefend.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Luminosity
    PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Defender" /tr "'C:\Program Files (x86)\WindowsDefender\windefend.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Luminosity
    PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Defender" /tr "'C:\Program Files (x86)\WindowsDefender\windefend.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Luminosity
    - Creates scheduled task(s)
    PID:1004
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Defender" /d "cmd /c """start """Defender""" """C:\Program Files (x86)\WindowsDefender\windefend.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1940

C:\Windows\system32\taskeng.exe
taskeng.exe {00BAB014-521B-4970-81BC-0B6A15A8BC90} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\WindowsDefender\windefend.exe
  "C:\Program Files (x86)\WindowsDefender\windefend.exe" /startup
  2⤵
  - Executes dropped EXE
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsDefender\windefend.exe

Filesize
858KB

MD5
3e5fb382da9a26f323fc42d3250d7522

SHA1
d41699c479f1e1a820c20c3629c1a28555b21d2e

SHA256
1c50c8db063b3fb460615b12c915c646abdb9be8e50bd24bb52def2195d02fa4

SHA512
cf8cf28684574ea6de7d1a8262aa9482c56bbde7651cb75641d04e654eb22d21fdebe33595b2a668de42dfea71af8adf354da39fd5e468f62b5f934cc28c99a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Filesize
858KB

MD5
3e5fb382da9a26f323fc42d3250d7522

SHA1
d41699c479f1e1a820c20c3629c1a28555b21d2e

SHA256
1c50c8db063b3fb460615b12c915c646abdb9be8e50bd24bb52def2195d02fa4

SHA512
cf8cf28684574ea6de7d1a8262aa9482c56bbde7651cb75641d04e654eb22d21fdebe33595b2a668de42dfea71af8adf354da39fd5e468f62b5f934cc28c99a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Filesize
858KB

MD5
3e5fb382da9a26f323fc42d3250d7522

SHA1
d41699c479f1e1a820c20c3629c1a28555b21d2e

SHA256
1c50c8db063b3fb460615b12c915c646abdb9be8e50bd24bb52def2195d02fa4

SHA512
cf8cf28684574ea6de7d1a8262aa9482c56bbde7651cb75641d04e654eb22d21fdebe33595b2a668de42dfea71af8adf354da39fd5e468f62b5f934cc28c99a7

Download Submit
\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Filesize
858KB

MD5
3e5fb382da9a26f323fc42d3250d7522

SHA1
d41699c479f1e1a820c20c3629c1a28555b21d2e

SHA256
1c50c8db063b3fb460615b12c915c646abdb9be8e50bd24bb52def2195d02fa4

SHA512
cf8cf28684574ea6de7d1a8262aa9482c56bbde7651cb75641d04e654eb22d21fdebe33595b2a668de42dfea71af8adf354da39fd5e468f62b5f934cc28c99a7

Download Submit
\Users\Admin\AppData\Local\Temp\9bcf9639d945c18a3d549e7cdcac8c9dc3ba4019bc4ecfd4741422757f83a4c3.exe0

Filesize
858KB

MD5
3e5fb382da9a26f323fc42d3250d7522

SHA1
d41699c479f1e1a820c20c3629c1a28555b21d2e

SHA256
1c50c8db063b3fb460615b12c915c646abdb9be8e50bd24bb52def2195d02fa4

SHA512
cf8cf28684574ea6de7d1a8262aa9482c56bbde7651cb75641d04e654eb22d21fdebe33595b2a668de42dfea71af8adf354da39fd5e468f62b5f934cc28c99a7

Download Submit
memory/1104-60-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-59-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1376-68-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads