Overview

overview

10

Static

static

New PO 800...20.exe

windows7_x64

10

New PO 800...20.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20/05/2022, 22:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New PO 8003987747484873672020.exe
  • Size 293KB
  • Sample220520-2a7z4aabcl
  • SHA256 2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
  • MD5 SHA1 SHA512
Score
10/10
luminositypersistencerat

Malware Config

Signatures

  • Luminosity 2 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

    ratluminosity
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New PO 8003987747484873672020.exe
    "C:\Users\Admin\AppData\Local\Temp\New PO 8003987747484873672020.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QFUlQILxU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE96.tmp"
      2⤵
      • Luminosity
      PID:3524
    • C:\Users\Admin\AppData\Local\Temp\New PO 8003987747484873672020.exe
      "C:\Users\Admin\AppData\Local\Temp\New PO 8003987747484873672020.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\ProgramData\213113\anibtcent.exe.exe
        "C:\ProgramData\213113\anibtcent.exe.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QFUlQILxU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9191.tmp"
          4⤵
          • Luminosity
          • Creates scheduled task(s)
          PID:3176
        • C:\ProgramData\213113\anibtcent.exe.exe
          "C:\ProgramData\213113\anibtcent.exe.exe"
          4⤵
          • Executes dropped EXE
          PID:4336

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        anibtcent.exe.exe
        • Path C:\ProgramData\213113\anibtcent.exe.exe
        • Size 293KB
        • SHA256 2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        anibtcent.exe.exe
        • Path C:\ProgramData\213113\anibtcent.exe.exe
        • Size 293KB
        • SHA256 2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        anibtcent.exe.exe
        • Path C:\ProgramData\213113\anibtcent.exe.exe
        • Size 293KB
        • SHA256 2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        New PO 8003987747484873672020.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 8003987747484873672020.exe.log
        • Size 507B
        • SHA256 f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
        • MD5 SHA1 SHA512
        Submit Download

        anibtcent.exe.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\anibtcent.exe.exe.log
        • Size 507B
        • SHA256 f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
        • MD5 SHA1 SHA512
        Submit Download

        tmp9191.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp9191.tmp
        • Size 1KB
        • SHA256 1c78724d0b2dfa00fd6cfe33f1046769553ca79c97031060eb54620b3e3bcac8
        • MD5 SHA1 SHA512
        Submit Download

        tmpE96.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpE96.tmp
        • Size 1KB
        • SHA256 1c78724d0b2dfa00fd6cfe33f1046769553ca79c97031060eb54620b3e3bcac8
        • MD5 SHA1 SHA512
        Submit Download

        memory/112-130-0x00000000001D0000-0x0000000000220000-memory.dmp
        Download

        memory/112-133-0x0000000005750000-0x00000000057EC000-memory.dmp
        Download

        memory/112-132-0x0000000004BF0000-0x0000000004C82000-memory.dmp
        Download

        memory/112-131-0x0000000005100000-0x00000000056A4000-memory.dmp
        Download

        memory/1960-137-0x0000000000400000-0x000000000043E000-memory.dmp
        Download

        memory/1960-139-0x0000000005700000-0x0000000005766000-memory.dmp
        Download