Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-07-2022 06:55

General

  • Target

    475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac.exe

  • Size

    709KB

  • MD5

    a774b9f4913630c8f5cceaf860f7f831

  • SHA1

    538824b34fea1680b26c960c801696ca4bac0680

  • SHA256

    475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac

  • SHA512

    cae80570446172eb9fe4d815ea610fe9484459a9371374b256c518ef0afaccc549092084d5ccc0433ea302ece6624fc4ba5c0b4143629c35d1b1def370e5dfb7

Malware Config

Signatures

  • Luminosity 1 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac.exe
    "C:\Users\Admin\AppData\Local\Temp\475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac.exe
      "C:\Users\Admin\AppData\Local\Temp\475e8d3f51b69463408ea38a6e236eef934a2593c3573eab86f5f3bd43c6c6ac.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe' /startup" /f
        3⤵
        • Luminosity
        • Creates scheduled task(s)
        • Suspicious behavior: EnumeratesProcesses
        PID:2504

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1876-130-0x00000000747B0000-0x0000000074D61000-memory.dmp

    Filesize

    5.7MB

  • memory/1876-131-0x00000000747B0000-0x0000000074D61000-memory.dmp

    Filesize

    5.7MB

  • memory/1876-134-0x00000000747B0000-0x0000000074D61000-memory.dmp

    Filesize

    5.7MB

  • memory/2504-138-0x0000000000710000-0x0000000000727000-memory.dmp

    Filesize

    92KB

  • memory/2504-140-0x0000000000710000-0x0000000000727000-memory.dmp

    Filesize

    92KB

  • memory/2504-139-0x0000000000710000-0x0000000000727000-memory.dmp

    Filesize

    92KB

  • memory/4808-133-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/4808-135-0x00000000747B0000-0x0000000074D61000-memory.dmp

    Filesize

    5.7MB

  • memory/4808-136-0x00000000747B0000-0x0000000074D61000-memory.dmp

    Filesize

    5.7MB