Analysis

  • max time kernel
    146s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2022 13:01

General

  • Target

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe

  • Size

    334KB

  • MD5

    64e30d1221acec586a7891837aa32ba0

  • SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

  • SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

  • SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • SSDEEP

    6144:Dq9tNBg54SOPiH3LTOwIDi4bNu7H4fXAKucXLAey/xHVanM4oVUzp8al0LxfP59F:V5l3+wI3hvd7LA5/+MrUt8aQfP0e

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe
    "C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe
      "C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\ProgramData\976615\sysmon.exe
        "C:\ProgramData\976615\sysmon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\ProgramData\976615\sysmon.exe
          "C:\ProgramData\976615\sysmon.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1532

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\976615\sysmon.exe

    Filesize

    334KB

    MD5

    64e30d1221acec586a7891837aa32ba0

    SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

    SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

    SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • C:\ProgramData\976615\sysmon.exe

    Filesize

    334KB

    MD5

    64e30d1221acec586a7891837aa32ba0

    SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

    SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

    SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • C:\ProgramData\976615\sysmon.exe

    Filesize

    334KB

    MD5

    64e30d1221acec586a7891837aa32ba0

    SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

    SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

    SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • \ProgramData\976615\sysmon.exe

    Filesize

    334KB

    MD5

    64e30d1221acec586a7891837aa32ba0

    SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

    SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

    SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • \ProgramData\976615\sysmon.exe

    Filesize

    334KB

    MD5

    64e30d1221acec586a7891837aa32ba0

    SHA1

    9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab

    SHA256

    978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526

    SHA512

    3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4

  • memory/1280-55-0x0000000074500000-0x0000000074AAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1280-67-0x0000000074500000-0x0000000074AAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmp

    Filesize

    8KB

  • memory/1464-79-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/1464-92-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/1532-97-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/1532-109-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-98-0x00000000009F0000-0x0000000000A07000-memory.dmp

    Filesize

    92KB

  • memory/2044-68-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-70-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-63-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-59-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-57-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-72-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-104-0x00000000009F0000-0x0000000000A07000-memory.dmp

    Filesize

    92KB

  • memory/2044-107-0x00000000009F0000-0x0000000000A07000-memory.dmp

    Filesize

    92KB

  • memory/2044-101-0x00000000009F0000-0x0000000000A07000-memory.dmp

    Filesize

    92KB

  • memory/2044-99-0x00000000009F0000-0x0000000000A07000-memory.dmp

    Filesize

    92KB

  • memory/2044-108-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-56-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-110-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB