Analysis

  • max time kernel
    165s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 22:08

General

  • Target

    c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe

  • Size

    420KB

  • MD5

    082511600ec66244ec7ffe1a57c6f6ea

  • SHA1

    f7a942011e8969fde4e196f496b497a5694e747f

  • SHA256

    c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6

  • SHA512

    3d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0

  • SSDEEP

    12288:NWmWT0MI9WCedrA70Hd6lHnBhqITb3bDTt0BiOLzu3WT:MmWTE9WCSrGdtBtTbOBQ3

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe
    "C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe
      "C:\Users\Admin\AppData\Local\Temp\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\ProgramData\394723\sysmon.exe
        "C:\ProgramData\394723\sysmon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\ProgramData\394723\sysmon.exe
          "C:\ProgramData\394723\sysmon.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2744

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\394723\sysmon.exe

    Filesize

    420KB

    MD5

    082511600ec66244ec7ffe1a57c6f6ea

    SHA1

    f7a942011e8969fde4e196f496b497a5694e747f

    SHA256

    c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6

    SHA512

    3d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0

  • C:\ProgramData\394723\sysmon.exe

    Filesize

    420KB

    MD5

    082511600ec66244ec7ffe1a57c6f6ea

    SHA1

    f7a942011e8969fde4e196f496b497a5694e747f

    SHA256

    c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6

    SHA512

    3d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0

  • C:\ProgramData\394723\sysmon.exe

    Filesize

    420KB

    MD5

    082511600ec66244ec7ffe1a57c6f6ea

    SHA1

    f7a942011e8969fde4e196f496b497a5694e747f

    SHA256

    c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6

    SHA512

    3d8dbb120d10243af503f0d24ea225b281919046db21ac0f6cd980480d8e4e41ac5a53a1904011ac9161893c1cf550cdbf1cd7b9dca2c7e605475da84e839ea0

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c4c2fe92cb601c0cc6ac87b5541d7c1a462801942475351c4dfda26296faefa6.exe.log

    Filesize

    411B

    MD5

    39582d3351c79bbe6b34c92b86bb2e15

    SHA1

    0a5bc37313778570ffd8b7664fd04380446641f3

    SHA256

    a77ea8a3f342c18bc35e84d0c0255345ae259f80dd9ac4837760e5e4d5f593aa

    SHA512

    4e6acca2e4fd55d3dcdcaba0155364dcf17924113f23bb58c895e0119a79906f4e3fd1950d1dbb405cc02509373a1e2057a46dbc364189779ae96abb19214283

  • memory/516-132-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/516-136-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/1188-146-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/1188-145-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/2072-148-0x0000000006C60000-0x0000000006C77000-memory.dmp

    Filesize

    92KB

  • memory/2072-138-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/2072-137-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/2072-134-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2072-150-0x0000000006C60000-0x0000000006C77000-memory.dmp

    Filesize

    92KB

  • memory/2072-149-0x0000000006C60000-0x0000000006C77000-memory.dmp

    Filesize

    92KB

  • memory/2072-152-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/2744-147-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB

  • memory/2744-151-0x0000000074ED0000-0x0000000075481000-memory.dmp

    Filesize

    5.7MB