Overview

overview

10

Static

static

0e9e6ee83a...9f.exe

windows7-x64

10

0e9e6ee83a...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e9e6ee83a8a08a88332aed0feb005820931952b515dbd1ce742cc5529827b9f

  • Size

    692KB

  • Sample

    221126-w3c3jahc5y

  • MD5

    36917de8baf55c2061d3e2cfbd63c26f

  • SHA1

    7ecd8a25b4f502f361f1cb872ea1624b7040dba7

  • SHA256

    0e9e6ee83a8a08a88332aed0feb005820931952b515dbd1ce742cc5529827b9f

  • SHA512

    864cf3d5074930fee8f6d9e00c344e9354c411d5906257e2dbc2c36b18561c25727694202d5493596796b4bb351dec0f6eb35bc92972a31d1427d153d05166be

  • SSDEEP

    12288:BV570Nf52WBFn4Qx15wPsulqyQgcCQBRrX49sKrDUhV9fpzkCG:T547Fn4eTrulfDnfshV9fJ

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      0e9e6ee83a8a08a88332aed0feb005820931952b515dbd1ce742cc5529827b9f

    • Size

      692KB

    • MD5

      36917de8baf55c2061d3e2cfbd63c26f

    • SHA1

      7ecd8a25b4f502f361f1cb872ea1624b7040dba7

    • SHA256

      0e9e6ee83a8a08a88332aed0feb005820931952b515dbd1ce742cc5529827b9f

    • SHA512

      864cf3d5074930fee8f6d9e00c344e9354c411d5906257e2dbc2c36b18561c25727694202d5493596796b4bb351dec0f6eb35bc92972a31d1427d153d05166be

    • SSDEEP

      12288:BV570Nf52WBFn4Qx15wPsulqyQgcCQBRrX49sKrDUhV9fpzkCG:T547Fn4eTrulfDnfshV9fJ

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks