Analysis

  • max time kernel
    172s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 22:21

General

  • Target

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe

  • Size

    340KB

  • MD5

    9a75c88a2ff5bb528cda6020d33cff63

  • SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

  • SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

  • SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • SSDEEP

    6144:hEWv7VO2OT9r+Mh5FOQLh2zhaK0K3hdt9GDwg2aUfydY+C2nP:hEWv7VO2OTjvRLSazK3hdVcUfyfC2nP

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe
    "C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe
      "C:\Users\Admin\AppData\Local\Temp\903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\ProgramData\173775\helper.exe
        "C:\ProgramData\173775\helper.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\ProgramData\173775\helper.exe
          "C:\ProgramData\173775\helper.exe"
          4⤵
          • Executes dropped EXE
          PID:632
        • C:\ProgramData\173775\helper.exe
          "C:\ProgramData\173775\helper.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\173775\helper.exe

    Filesize

    340KB

    MD5

    9a75c88a2ff5bb528cda6020d33cff63

    SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

    SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

    SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • C:\ProgramData\173775\helper.exe

    Filesize

    340KB

    MD5

    9a75c88a2ff5bb528cda6020d33cff63

    SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

    SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

    SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • C:\ProgramData\173775\helper.exe

    Filesize

    340KB

    MD5

    9a75c88a2ff5bb528cda6020d33cff63

    SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

    SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

    SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • C:\ProgramData\173775\helper.exe

    Filesize

    340KB

    MD5

    9a75c88a2ff5bb528cda6020d33cff63

    SHA1

    07ffcc093be2fd45e0c3d253b12d068d5cb888db

    SHA256

    903e30cf0d7a6373b3b2e0dd51e76f3c13af36528ff8c9278728b2298b16f8c6

    SHA512

    b0cfaef076cf0aae7f94681ea9a3ad7050a378eb2a0c7b0d7803b7a93dd6d681602045e6a6cc987b56df2e805c348aa37b8619210ce2404bbda0e2dd91df8b90

  • memory/868-158-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/868-147-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/936-151-0x0000000006FD0000-0x0000000006FE7000-memory.dmp

    Filesize

    92KB

  • memory/936-152-0x0000000006FD0000-0x0000000006FE7000-memory.dmp

    Filesize

    92KB

  • memory/936-159-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/936-137-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/936-135-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/936-134-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/936-153-0x0000000006FD0000-0x0000000006FE7000-memory.dmp

    Filesize

    92KB

  • memory/1828-154-0x0000000001BE0000-0x0000000001BF7000-memory.dmp

    Filesize

    92KB

  • memory/1828-141-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/1828-155-0x0000000001BE0000-0x0000000001BF7000-memory.dmp

    Filesize

    92KB

  • memory/1828-156-0x0000000001BE0000-0x0000000001BF7000-memory.dmp

    Filesize

    92KB

  • memory/1828-157-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/5088-150-0x0000000001080000-0x0000000001097000-memory.dmp

    Filesize

    92KB

  • memory/5088-132-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB

  • memory/5088-149-0x0000000001080000-0x0000000001097000-memory.dmp

    Filesize

    92KB

  • memory/5088-148-0x0000000001080000-0x0000000001097000-memory.dmp

    Filesize

    92KB

  • memory/5088-136-0x0000000075080000-0x0000000075631000-memory.dmp

    Filesize

    5.7MB