Analysis

  • max time kernel
    151s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 22:05

General

  • Target

    991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49.exe

  • Size

    304KB

  • MD5

    ec0e16a749b1bf804b7f52b5a1ea4180

  • SHA1

    b7a7f1b85544b3d8b9aca5591a0067a2a9c28897

  • SHA256

    991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49

  • SHA512

    9299e0a60cfef3d1c235952cd81efd7ea150660a341e9b4dc389365c13d6c10078d27063fa584f3b44169b9aab3ca9fc03777af88633eb2ea3cb7f2357db2582

  • SSDEEP

    6144:uyA0uOSNfMV8q2noNrw0uaoyF7CW0yWo339vcy06BB8Zi:7AnKVecw0Z7qyWAvcy06BB8Zi

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49.exe
    "C:\Users\Admin\AppData\Local\Temp\991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Users\Admin\AppData\Local\Temp\991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49.exe
      "C:\Users\Admin\AppData\Local\Temp\991be6e51fb27ce5b3951ba3eda85e46268c9e39c6034ca15500a2efc3f54f49.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:1104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1104-56-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-57-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-59-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-63-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-68-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-70-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1104-72-0x00000000742D0000-0x000000007487B000-memory.dmp

    Filesize

    5.7MB

  • memory/1104-73-0x00000000742D0000-0x000000007487B000-memory.dmp

    Filesize

    5.7MB

  • memory/1900-54-0x0000000075981000-0x0000000075983000-memory.dmp

    Filesize

    8KB

  • memory/1900-55-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1900-67-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB