Analysis

  • max time kernel
    149s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2022 13:40

General

  • Target

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338.exe

  • Size

    1.4MB

  • MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

  • SHA1

    bd706034409b6e6556920727c97e07eef28035f6

  • SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

  • SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • SSDEEP

    24576:ZRon1G/j+J1rUyv4iBImufwpH1RH17qhsaQO51HYrq/cHYIAmTXs0x/GphJq:Z8c/yHz/BfHRIUqcHBmb

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338.exe
    "C:\Users\Admin\AppData\Local\Temp\5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338.exe
      C:\Users\Admin\AppData\Local\Temp\5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\ProgramData\539545\sysmon.exe
        "C:\ProgramData\539545\sysmon.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\ProgramData\539545\sysmon.exe
          C:\ProgramData\539545\sysmon.exe
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • C:\ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • C:\ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe

    Filesize

    52KB

    MD5

    278edbd499374bf73621f8c1f969d894

    SHA1

    a81170af14747781c5f5f51bb1215893136f0bc0

    SHA256

    c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

    SHA512

    93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • \ProgramData\539545\sysmon.exe

    Filesize

    1.4MB

    MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

    SHA1

    bd706034409b6e6556920727c97e07eef28035f6

    SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • memory/1048-88-0x00000000004390CE-mapping.dmp

  • memory/1048-98-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1048-111-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1292-81-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1292-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

    Filesize

    8KB

  • memory/1292-67-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1664-70-0x0000000000000000-mapping.dmp

  • memory/1664-109-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1664-82-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/1664-78-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-58-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-100-0x0000000000920000-0x0000000000937000-memory.dmp

    Filesize

    92KB

  • memory/2044-61-0x00000000004390CE-mapping.dmp

  • memory/2044-60-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-65-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-56-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-99-0x0000000000920000-0x0000000000937000-memory.dmp

    Filesize

    92KB

  • memory/2044-63-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-102-0x0000000000920000-0x0000000000937000-memory.dmp

    Filesize

    92KB

  • memory/2044-105-0x0000000000920000-0x0000000000937000-memory.dmp

    Filesize

    92KB

  • memory/2044-108-0x0000000000920000-0x0000000000937000-memory.dmp

    Filesize

    92KB

  • memory/2044-68-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-110-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB

  • memory/2044-55-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2044-112-0x0000000074950000-0x0000000074EFB000-memory.dmp

    Filesize

    5.7MB