Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 13:01
Static task
static1
Behavioral task
behavioral1
Sample
978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe
Resource
win10v2004-20220901-en
General
-
Target
978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe
-
Size
334KB
-
MD5
64e30d1221acec586a7891837aa32ba0
-
SHA1
9c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
-
SHA256
978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
-
SHA512
3e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
SSDEEP
6144:Dq9tNBg54SOPiH3LTOwIDi4bNu7H4fXAKucXLAey/xHVanM4oVUzp8al0LxfP59F:V5l3+wI3hvd7LA5/+MrUt8aQfP0e
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\326646\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 4 IoCs
pid Process 3256 sysmon.exe 4072 sysmon.exe 4536 sysmon.exe 1344 sysmon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\326646\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1884 set thread context of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 3256 set thread context of 1344 3256 sysmon.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe 1344 sysmon.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1344 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1344 sysmon.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 1884 wrote to memory of 4912 1884 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 84 PID 4912 wrote to memory of 3256 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 85 PID 4912 wrote to memory of 3256 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 85 PID 4912 wrote to memory of 3256 4912 978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe 85 PID 3256 wrote to memory of 4072 3256 sysmon.exe 86 PID 3256 wrote to memory of 4072 3256 sysmon.exe 86 PID 3256 wrote to memory of 4072 3256 sysmon.exe 86 PID 3256 wrote to memory of 4536 3256 sysmon.exe 87 PID 3256 wrote to memory of 4536 3256 sysmon.exe 87 PID 3256 wrote to memory of 4536 3256 sysmon.exe 87 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 3256 wrote to memory of 1344 3256 sysmon.exe 88 PID 1344 wrote to memory of 4912 1344 sysmon.exe 84 PID 1344 wrote to memory of 4912 1344 sysmon.exe 84 PID 1344 wrote to memory of 4912 1344 sysmon.exe 84 PID 1344 wrote to memory of 4912 1344 sysmon.exe 84 PID 1344 wrote to memory of 4912 1344 sysmon.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"C:\Users\Admin\AppData\Local\Temp\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\ProgramData\326646\sysmon.exe"C:\ProgramData\326646\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\ProgramData\326646\sysmon.exe"C:\ProgramData\326646\sysmon.exe"4⤵
- Executes dropped EXE
PID:4072
-
-
C:\ProgramData\326646\sysmon.exe"C:\ProgramData\326646\sysmon.exe"4⤵
- Executes dropped EXE
PID:4536
-
-
C:\ProgramData\326646\sysmon.exe"C:\ProgramData\326646\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
334KB
MD564e30d1221acec586a7891837aa32ba0
SHA19c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
SHA256978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
SHA5123e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
Filesize
334KB
MD564e30d1221acec586a7891837aa32ba0
SHA19c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
SHA256978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
SHA5123e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
Filesize
334KB
MD564e30d1221acec586a7891837aa32ba0
SHA19c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
SHA256978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
SHA5123e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
Filesize
334KB
MD564e30d1221acec586a7891837aa32ba0
SHA19c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
SHA256978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
SHA5123e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
Filesize
334KB
MD564e30d1221acec586a7891837aa32ba0
SHA19c8d57a46c2e916ab2a9661bb8d2f8de5c8575ab
SHA256978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526
SHA5123e35da1a1eae02d1a02d5ebb48403778e7e3049f735a6ffcb62318b4b99f4303f83cb9ab36bb3dcec82266b7477d1af32f7a092b033133eefb6adacd979437c4
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\978348543f663b01ca6653042fbfdddf72d26f6c418c8e2c9a6a20857accd526.exe.log
Filesize400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307