Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2022 19:52

General

  • Target

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c.exe

  • Size

    168KB

  • MD5

    aa7814ec18864f0b90a1100a624cb1fd

  • SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

  • SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

  • SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • SSDEEP

    3072:bk5zdU9Qy3RDAMx4k3HeSUNz2Pbjc7bN5nzI9CUTjcqyCKGBp2gGrND0GU:w5zd8RDr6zSAqPbjMbnzpWIqvKGtg

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c.exe
    "C:\Users\Admin\AppData\Local\Temp\8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c.exe
      "C:\Users\Admin\AppData\Local\Temp\8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\ProgramData\862021\explorer.exe
        "C:\ProgramData\862021\explorer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\ProgramData\862021\explorer.exe
          "C:\ProgramData\862021\explorer.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:808

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\862021\explorer.exe

    Filesize

    168KB

    MD5

    aa7814ec18864f0b90a1100a624cb1fd

    SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

    SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • C:\ProgramData\862021\explorer.exe

    Filesize

    168KB

    MD5

    aa7814ec18864f0b90a1100a624cb1fd

    SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

    SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • C:\ProgramData\862021\explorer.exe

    Filesize

    168KB

    MD5

    aa7814ec18864f0b90a1100a624cb1fd

    SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

    SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • \ProgramData\862021\explorer.exe

    Filesize

    168KB

    MD5

    aa7814ec18864f0b90a1100a624cb1fd

    SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

    SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • \ProgramData\862021\explorer.exe

    Filesize

    168KB

    MD5

    aa7814ec18864f0b90a1100a624cb1fd

    SHA1

    81f5af5bb7b98d4f4901330aadce275cf8529453

    SHA256

    8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    SHA512

    7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

  • memory/740-71-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/740-60-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/740-65-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/740-67-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/740-69-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/740-95-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/740-62-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/740-58-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/740-57-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/808-92-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/808-96-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/1948-78-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/1948-93-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/1948-94-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-56-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-55-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

    Filesize

    8KB

  • memory/2020-70-0x00000000741F0000-0x000000007479B000-memory.dmp

    Filesize

    5.7MB