Overview

overview

10

Static

static

8

f71019c44c...f7.exe

windows7-x64

10

f71019c44c...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f71019c44cdb9c7f429a775d23406b5262f010ea465f75e35660a79f788e90f7

  • Size

    823KB

  • Sample

    221126-24fgyaca25

  • MD5

    12e6771c261c522bc702ab413ce3f7f6

  • SHA1

    19e299d59236739b3f826c5d37723d39aa28489d

  • SHA256

    f71019c44cdb9c7f429a775d23406b5262f010ea465f75e35660a79f788e90f7

  • SHA512

    9ae5ce4484a0cb3d2681aee3ee6a1d22e78858341d182c091c66d7a5128e8f730a1e70660366a27767bdeb5305ee311e85a00865fdc750d8ea844026053f82ab

  • SSDEEP

    12288:y6Wq4aaE6KwyF5L0Y2D1PqLX7okJixkya90M7iNgtsgnEemtGqBgkUhBF/eLzkw:wthEVaPqLbmkR9Bu+sremtngPXFGL1

Score
10/10
luminositypersistenceratupx

Malware Config

Targets

    • Target

      f71019c44cdb9c7f429a775d23406b5262f010ea465f75e35660a79f788e90f7

    • Size

      823KB

    • MD5

      12e6771c261c522bc702ab413ce3f7f6

    • SHA1

      19e299d59236739b3f826c5d37723d39aa28489d

    • SHA256

      f71019c44cdb9c7f429a775d23406b5262f010ea465f75e35660a79f788e90f7

    • SHA512

      9ae5ce4484a0cb3d2681aee3ee6a1d22e78858341d182c091c66d7a5128e8f730a1e70660366a27767bdeb5305ee311e85a00865fdc750d8ea844026053f82ab

    • SSDEEP

      12288:y6Wq4aaE6KwyF5L0Y2D1PqLX7okJixkya90M7iNgtsgnEemtGqBgkUhBF/eLzkw:wthEVaPqLbmkR9Bu+sremtngPXFGL1

    Score
    10/10
    luminositypersistenceratupx

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks