Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 22:08
Static task
static1
Behavioral task
behavioral1
Sample
c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe
Resource
win10v2004-20220812-en
General
-
Target
c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe
-
Size
420KB
-
MD5
082511600ec66244ec7ffe1a57c6f6ea
-
SHA1
f7a942011e8969fde4e196f496b497a5694e747f
-
SHA256
c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
-
SHA512
3d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0
-
SSDEEP
12288:NWmWT0MI9WCedrA70Hd6lHnBhqITb3bDTt0BiOLzu3WT:MmWTE9WCSrGdtBtTbOBQ3
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\200987\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 1492 sysmon.exe 1984 sysmon.exe -
Loads dropped DLL 2 IoCs
pid Process 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\200987\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1768 set thread context of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1492 set thread context of 1984 1492 sysmon.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1984 sysmon.exe 1984 sysmon.exe 1984 sysmon.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1984 sysmon.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1768 wrote to memory of 1584 1768 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 28 PID 1584 wrote to memory of 1492 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 29 PID 1584 wrote to memory of 1492 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 29 PID 1584 wrote to memory of 1492 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 29 PID 1584 wrote to memory of 1492 1584 c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe 29 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30 PID 1492 wrote to memory of 1984 1492 sysmon.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\ProgramData\200987\sysmon.exe"C:\ProgramData\200987\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\ProgramData\200987\sysmon.exe"C:\ProgramData\200987\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5082511600ec66244ec7ffe1a57c6f6ea
SHA1f7a942011e8969fde4e196f496b497a5694e747f
SHA256c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
SHA5123d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0
-
Filesize
420KB
MD5082511600ec66244ec7ffe1a57c6f6ea
SHA1f7a942011e8969fde4e196f496b497a5694e747f
SHA256c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
SHA5123d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0
-
Filesize
420KB
MD5082511600ec66244ec7ffe1a57c6f6ea
SHA1f7a942011e8969fde4e196f496b497a5694e747f
SHA256c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
SHA5123d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0
-
Filesize
420KB
MD5082511600ec66244ec7ffe1a57c6f6ea
SHA1f7a942011e8969fde4e196f496b497a5694e747f
SHA256c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
SHA5123d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0
-
Filesize
420KB
MD5082511600ec66244ec7ffe1a57c6f6ea
SHA1f7a942011e8969fde4e196f496b497a5694e747f
SHA256c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6
SHA5123d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0