Analysis
-
max time kernel
153s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 15:18
Static task
static1
Behavioral task
behavioral1
Sample
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
Resource
win10v2004-20220812-en
General
-
Target
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
-
Size
372KB
-
MD5
4beb9aa614a6adf13b28f2788eb60d10
-
SHA1
fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
-
SHA256
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
-
SHA512
08495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
SSDEEP
6144:Dr65XFOexNydkH2xC+8DD287dU8zt0AW+SRCzo2Dwp4PrxNY:Dr614RxeX2+4vRCzos5rfY
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\553736\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 1048 sysmon.exe 1856 sysmon.exe -
Loads dropped DLL 1 IoCs
pid Process 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\553736\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1236 set thread context of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1048 set thread context of 1856 1048 sysmon.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1856 sysmon.exe 1856 sysmon.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1856 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1856 sysmon.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1236 wrote to memory of 1168 1236 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 28 PID 1168 wrote to memory of 1048 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 30 PID 1168 wrote to memory of 1048 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 30 PID 1168 wrote to memory of 1048 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 30 PID 1168 wrote to memory of 1048 1168 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 30 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31 PID 1048 wrote to memory of 1856 1048 sysmon.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\ProgramData\553736\sysmon.exe"C:\ProgramData\553736\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\ProgramData\553736\sysmon.exe"C:\ProgramData\553736\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79