Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2022 13:29

General

  • Target

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec.exe

  • Size

    402KB

  • MD5

    da12d3c00497b8527b7943e3579e52d9

  • SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

  • SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

  • SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • SSDEEP

    6144:8C0O/wK2CBCy0PlwYsmF/rM2SckT/06DCd:OjKeyPQF/rMJT/0

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec.exe
    "C:\Users\Admin\AppData\Local\Temp\189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec.exe
      "C:\Users\Admin\AppData\Local\Temp\189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\ProgramData\445779\helper.exe
        "C:\ProgramData\445779\helper.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\ProgramData\445779\helper.exe
          "C:\ProgramData\445779\helper.exe"
          4⤵
          • Executes dropped EXE
          PID:1292
        • C:\ProgramData\445779\helper.exe
          "C:\ProgramData\445779\helper.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • C:\ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • C:\ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • C:\ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • \ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • \ProgramData\445779\helper.exe

    Filesize

    402KB

    MD5

    da12d3c00497b8527b7943e3579e52d9

    SHA1

    9f7489fc7b6171eadc37cf813bd81c6482e101f0

    SHA256

    189c62dc575e463968cae907673b30170b261ab707c804d244c8b79e1f4be8ec

    SHA512

    7648a29785771f1c5551968e6f09c0b636ec60022efdafd5689c37791cf28ad801b9f0f064f2973c93b5be4b8d2cabbd8d2691e939d225f2456fb3861b8e071e

  • memory/980-60-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/980-65-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/980-92-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/980-68-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/980-63-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/980-94-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/980-58-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/980-56-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/980-55-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/1048-67-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/1060-87-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1204-90-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1204-91-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1204-93-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB