Analysis

  • max time kernel
    170s
  • max time network
    249s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 13:57

General

  • Target

    ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe

  • Size

    362KB

  • MD5

    6e3cf25df78c855156761cea3155462f

  • SHA1

    0e5af76cda2f4a4ffa22486b3a73ca80b36980b8

  • SHA256

    ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42

  • SHA512

    85b4b69268a453659c7c28b2def0bc6c7e41bfb672425c6fd3dd9d23e92bbc744b1e388aa80d6a07ee4a315a8d2e300e0482a2a0b131f28605968db3abd66624

  • SSDEEP

    6144:y8LU7dZMuhAwR95/m7RmqJSkGWpYE/bmoSoZhN2i/0Qc2k0L9CZq:RU7diuhP1/oRTS8jmoXBsjh6wZq

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe
    "C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe
      "C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe"
      2⤵
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe
        "C:\Users\Admin\AppData\Local\Temp\ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\ProgramData\683827\helper.exe
          "C:\ProgramData\683827\helper.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:684
          • C:\ProgramData\683827\helper.exe
            "C:\ProgramData\683827\helper.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:556

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\683827\helper.exe

      Filesize

      362KB

      MD5

      6e3cf25df78c855156761cea3155462f

      SHA1

      0e5af76cda2f4a4ffa22486b3a73ca80b36980b8

      SHA256

      ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42

      SHA512

      85b4b69268a453659c7c28b2def0bc6c7e41bfb672425c6fd3dd9d23e92bbc744b1e388aa80d6a07ee4a315a8d2e300e0482a2a0b131f28605968db3abd66624

    • C:\ProgramData\683827\helper.exe

      Filesize

      362KB

      MD5

      6e3cf25df78c855156761cea3155462f

      SHA1

      0e5af76cda2f4a4ffa22486b3a73ca80b36980b8

      SHA256

      ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42

      SHA512

      85b4b69268a453659c7c28b2def0bc6c7e41bfb672425c6fd3dd9d23e92bbc744b1e388aa80d6a07ee4a315a8d2e300e0482a2a0b131f28605968db3abd66624

    • C:\ProgramData\683827\helper.exe

      Filesize

      362KB

      MD5

      6e3cf25df78c855156761cea3155462f

      SHA1

      0e5af76cda2f4a4ffa22486b3a73ca80b36980b8

      SHA256

      ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42

      SHA512

      85b4b69268a453659c7c28b2def0bc6c7e41bfb672425c6fd3dd9d23e92bbc744b1e388aa80d6a07ee4a315a8d2e300e0482a2a0b131f28605968db3abd66624

    • \ProgramData\683827\helper.exe

      Filesize

      362KB

      MD5

      6e3cf25df78c855156761cea3155462f

      SHA1

      0e5af76cda2f4a4ffa22486b3a73ca80b36980b8

      SHA256

      ab0c7b8675aa676dde1de0c67ebbcac22fec306dc969541289e285b06ac22f42

      SHA512

      85b4b69268a453659c7c28b2def0bc6c7e41bfb672425c6fd3dd9d23e92bbc744b1e388aa80d6a07ee4a315a8d2e300e0482a2a0b131f28605968db3abd66624

    • memory/556-90-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/556-92-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/684-89-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/684-75-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/936-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

      Filesize

      8KB

    • memory/936-68-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/936-55-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/1108-61-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-69-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/1108-64-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-66-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-59-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-57-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-91-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB

    • memory/1108-56-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/1108-93-0x0000000074C80000-0x000000007522B000-memory.dmp

      Filesize

      5.7MB