Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 15:18
Static task
static1
Behavioral task
behavioral1
Sample
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
Resource
win10v2004-20220812-en
General
-
Target
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe
-
Size
372KB
-
MD5
4beb9aa614a6adf13b28f2788eb60d10
-
SHA1
fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
-
SHA256
cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
-
SHA512
08495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
SSDEEP
6144:Dr65XFOexNydkH2xC+8DD287dU8zt0AW+SRCzo2Dwp4PrxNY:Dr614RxeX2+4vRCzos5rfY
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\334603\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 4348 sysmon.exe 4244 sysmon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\334603\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4984 set thread context of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4348 set thread context of 4244 4348 sysmon.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe 4244 sysmon.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4244 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4244 sysmon.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4984 wrote to memory of 4756 4984 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 82 PID 4756 wrote to memory of 4348 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 83 PID 4756 wrote to memory of 4348 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 83 PID 4756 wrote to memory of 4348 4756 cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe 83 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4348 wrote to memory of 4244 4348 sysmon.exe 84 PID 4244 wrote to memory of 4756 4244 sysmon.exe 82 PID 4244 wrote to memory of 4756 4244 sysmon.exe 82 PID 4244 wrote to memory of 4756 4244 sysmon.exe 82 PID 4244 wrote to memory of 4756 4244 sysmon.exe 82 PID 4244 wrote to memory of 4756 4244 sysmon.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"C:\Users\Admin\AppData\Local\Temp\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\ProgramData\334603\sysmon.exe"C:\ProgramData\334603\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\ProgramData\334603\sysmon.exe"C:\ProgramData\334603\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
Filesize
372KB
MD54beb9aa614a6adf13b28f2788eb60d10
SHA1fa29a3a6b2e0a4411bfc3f62fded045cca047c8f
SHA256cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7
SHA51208495fc0b552dd7dbd5b9fcacff1ca581bb4461721458439a82d2818e0dd51499e2f97ecea74b04b6b6112e710d37dc30da72ea9bc4584e8fbe4338a89dbad79
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\cd5d059cb8de607c0b81521cc5ad30308624ffedadbe5e3d947eb6c4e81a63d7.exe.log
Filesize594B
MD5fdb26b3b547022b45cfaeee57eafd566
SHA111c6798b8a59233f404014c5e79b3363cd564b37
SHA2562707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0
SHA51244d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700
-
Filesize
594B
MD5fdb26b3b547022b45cfaeee57eafd566
SHA111c6798b8a59233f404014c5e79b3363cd564b37
SHA2562707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0
SHA51244d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700