Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 22:21

General

  • Target

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe

  • Size

    340KB

  • MD5

    9a75c88a2ff5bb528cda6020d33cff63

  • SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

  • SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

  • SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • SSDEEP

    6144:hEWv7VO2OT9r+Mh5FOQLh2zhaK0K3hdt9GDwg2aUfydY+C2nP:hEWv7VO2OTjvRLSazK3hdVcUfyfC2nP

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe
    "C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe
      "C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe"
      2⤵
        PID:1684
      • C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe
        "C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:240
        • C:\ProgramData\481440\helper.exe
          "C:\ProgramData\481440\helper.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:708
          • C:\ProgramData\481440\helper.exe
            "C:\ProgramData\481440\helper.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1184

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\481440\helper.exe

      Filesize

      340KB

      MD5

      9a75c88a2ff5bb528cda6020d33cff63

      SHA1

      07ffcc093be2fd45e0c3d253b12d068d5cb888db

      SHA256

      903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

      SHA512

      b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

    • C:\ProgramData\481440\helper.exe

      Filesize

      340KB

      MD5

      9a75c88a2ff5bb528cda6020d33cff63

      SHA1

      07ffcc093be2fd45e0c3d253b12d068d5cb888db

      SHA256

      903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

      SHA512

      b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

    • C:\ProgramData\481440\helper.exe

      Filesize

      340KB

      MD5

      9a75c88a2ff5bb528cda6020d33cff63

      SHA1

      07ffcc093be2fd45e0c3d253b12d068d5cb888db

      SHA256

      903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

      SHA512

      b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

    • \ProgramData\481440\helper.exe

      Filesize

      340KB

      MD5

      9a75c88a2ff5bb528cda6020d33cff63

      SHA1

      07ffcc093be2fd45e0c3d253b12d068d5cb888db

      SHA256

      903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

      SHA512

      b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

    • \ProgramData\481440\helper.exe

      Filesize

      340KB

      MD5

      9a75c88a2ff5bb528cda6020d33cff63

      SHA1

      07ffcc093be2fd45e0c3d253b12d068d5cb888db

      SHA256

      903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

      SHA512

      b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

    • memory/240-63-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/240-60-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/240-65-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/240-94-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/240-68-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/240-58-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/240-91-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/240-56-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/240-55-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/708-88-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/708-92-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1184-89-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1184-93-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1960-90-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1960-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

      Filesize

      8KB

    • memory/1960-67-0x0000000073E20000-0x00000000743CB000-memory.dmp

      Filesize

      5.7MB