luminosity | c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

General

Target

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
Size

747KB
MD5

1c37fcc88038b6b8fc85accd0ebc8343
SHA1

101b3727f1145d9b4483540b00d48b6cf9a03943
SHA256

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b
SHA512

84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939
SSDEEP

12288:B8uHgGWdpwVNZ373QQi2p9CwhiifzhHj2gROW65Ruy6NejRPfD54pw:XWnw+R6CwPbhFRx65RuNejBftP

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
rat luminosity

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

helper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\""	helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\907489\\helper.exe\""	helper.exe

Executes dropped EXE 3 IoCs

Processes:

helper.exehelper.exehelper.exe

pid process

1324 helper.exe
1996 helper.exe
1660 helper.exe

pid	process
1324	helper.exe
1996	helper.exe
1660	helper.exe

Loads dropped DLL 2 IoCs

Processes:

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe

pid	process
520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

helper.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Helper = "\"C:\\ProgramData\\907489\\helper.exe\""	helper.exe

Drops file in System32 directory 2 IoCs

Processes:

helper.exe

description ioc process

File created C:\Windows\SysWOW64\clientsvr.exe helper.exe
File opened for modification C:\Windows\SysWOW64\clientsvr.exe helper.exe

description	ioc	process
File created	C:\Windows\SysWOW64\clientsvr.exe	helper.exe
File opened for modification	C:\Windows\SysWOW64\clientsvr.exe	helper.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exec818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exehelper.exehelper.exe

description	pid	process	target process
PID 960 set thread context of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 set thread context of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1324 set thread context of 1996	1324	helper.exe	helper.exe
PID 1996 set thread context of 1660	1996	helper.exe	helper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

helper.exec818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe

pid	process
1660	helper.exe
1660	helper.exe
1660	helper.exe
1660	helper.exe
1660	helper.exe
520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
1660	helper.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe

pid process

520 c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

helper.exe

description pid process

Token: SeDebugPrivilege 1660 helper.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

helper.exe

pid process

1660 helper.exe

description	pid	process
Token: SeDebugPrivilege	1660	helper.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exec818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exec818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exehelper.exehelper.exehelper.exe

description	pid	process	target process
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 960 wrote to memory of 1968	960	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 1904	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 1904	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 1904	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 1904	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1968 wrote to memory of 520	1968	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 520 wrote to memory of 1324	520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	helper.exe
PID 520 wrote to memory of 1324	520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	helper.exe
PID 520 wrote to memory of 1324	520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	helper.exe
PID 520 wrote to memory of 1324	520	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1324 wrote to memory of 1996	1324	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1996 wrote to memory of 1660	1996	helper.exe	helper.exe
PID 1660 wrote to memory of 520	1660	helper.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1660 wrote to memory of 520	1660	helper.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1660 wrote to memory of 520	1660	helper.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1660 wrote to memory of 520	1660	helper.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
PID 1660 wrote to memory of 520	1660	helper.exe	c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe

C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
"C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
  "C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
    "C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\ProgramData\907489\helper.exe
      "C:\ProgramData\907489\helper.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\ProgramData\907489\helper.exe
        
        "C:\ProgramData\907489\helper.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\ProgramData\907489\helper.exe
        
        "C:\ProgramData\907489\helper.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1660
- - C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe
    "C:\Users\Admin\AppData\Local\Temp\c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b.exe"
    3⤵
    PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
C:\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
C:\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
C:\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
\ProgramData\907489\helper.exe

Filesize
747KB

MD5
1c37fcc88038b6b8fc85accd0ebc8343

SHA1
101b3727f1145d9b4483540b00d48b6cf9a03943

SHA256
c818d9d86c869925d4ff82e2d17ac77300befcd1fe308191af7f10b246e37a6b

SHA512
84905fcaeda25bac0fea20b4270f6d8724889b8a4e2567b8f64caad4cc82d6560812cd9ebcbcf3478910c97e857254b444d34755c519681c9d4161c969b2d939

Download Submit
memory/520-87-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/520-133-0x0000000002150000-0x0000000002167000-memory.dmp

Filesize
92KB

Download
memory/520-141-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/520-129-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/520-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-80-0x00000000004390CE-mapping.dmp

Download
memory/520-78-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-130-0x0000000002150000-0x0000000002167000-memory.dmp

Filesize
92KB

Download
memory/520-83-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-85-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/520-131-0x0000000002150000-0x0000000002167000-memory.dmp

Filesize
92KB

Download
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-70-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1324-90-0x0000000000000000-mapping.dmp

Download
memory/1324-106-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1660-120-0x00000000004390CE-mapping.dmp

Download
memory/1660-128-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1660-140-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1968-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-64-0x000000000045C71E-mapping.dmp

Download
memory/1968-82-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1968-58-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1968-68-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1996-103-0x000000000045C71E-mapping.dmp

Download
memory/1996-123-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads