Analysis
-
max time kernel
153s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 18:01
Static task
static1
Behavioral task
behavioral1
Sample
257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe
Resource
win10v2004-20221111-en
General
-
Target
257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe
-
Size
258KB
-
MD5
220e4be9f75f1a8ed6091702fc0b7fe5
-
SHA1
4cae4f91647f96474eecd5e186a63e5d8451a11e
-
SHA256
257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d
-
SHA512
177bb7ae8e5e61cebdac28917e19afb053b3d77c408c12fe4bb6d91ab1eeef356c495f8da100c541052459b45f4dd32f00bfbd642925b57042e3e1e99c42bd22
-
SSDEEP
6144:95FgsZZ+c7PQBpWHiyu8Qu+tsrnFr9Ha4S9mhJMJAPMDmp:90s2BwHifXirFJa0hEAUDy
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" helper.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\514248\\helper.exe\"" helper.exe -
Executes dropped EXE 2 IoCs
pid Process 5012 helper.exe 3760 helper.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Computer Helper = "\"C:\\ProgramData\\514248\\helper.exe\"" helper.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe helper.exe File created C:\Windows\SysWOW64\clientsvr.exe helper.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1684 set thread context of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 5012 set thread context of 3760 5012 helper.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe 3760 helper.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1400 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3760 helper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3760 helper.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1684 wrote to memory of 1400 1684 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 85 PID 1400 wrote to memory of 5012 1400 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 86 PID 1400 wrote to memory of 5012 1400 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 86 PID 1400 wrote to memory of 5012 1400 257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe 86 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87 PID 5012 wrote to memory of 3760 5012 helper.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe"C:\Users\Admin\AppData\Local\Temp\257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe"C:\Users\Admin\AppData\Local\Temp\257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe"2⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\ProgramData\514248\helper.exe"C:\ProgramData\514248\helper.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\ProgramData\514248\helper.exe"C:\ProgramData\514248\helper.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3760
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5220e4be9f75f1a8ed6091702fc0b7fe5
SHA14cae4f91647f96474eecd5e186a63e5d8451a11e
SHA256257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d
SHA512177bb7ae8e5e61cebdac28917e19afb053b3d77c408c12fe4bb6d91ab1eeef356c495f8da100c541052459b45f4dd32f00bfbd642925b57042e3e1e99c42bd22
-
Filesize
258KB
MD5220e4be9f75f1a8ed6091702fc0b7fe5
SHA14cae4f91647f96474eecd5e186a63e5d8451a11e
SHA256257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d
SHA512177bb7ae8e5e61cebdac28917e19afb053b3d77c408c12fe4bb6d91ab1eeef356c495f8da100c541052459b45f4dd32f00bfbd642925b57042e3e1e99c42bd22
-
Filesize
258KB
MD5220e4be9f75f1a8ed6091702fc0b7fe5
SHA14cae4f91647f96474eecd5e186a63e5d8451a11e
SHA256257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d
SHA512177bb7ae8e5e61cebdac28917e19afb053b3d77c408c12fe4bb6d91ab1eeef356c495f8da100c541052459b45f4dd32f00bfbd642925b57042e3e1e99c42bd22
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\257d954b25d5d45b7ee8fd5bb47ad2e423e39f88a64da75e34e4a482a9728d1d.exe.log
Filesize312B
MD56dba4702b346903da02f7dd9e839a128
SHA1d69f255866f30a87c9eca8312d425c47059bf15e
SHA25629d145faac0201870c39b9119894f78694a776e03fc8f79349bdf92e56a65bcd
SHA51233afef187e806838717238881aaaf41272f8b484fcfe97a85057fd43a7eeb119df813d6023d2ee770aa22a067f7e9d532dd1c30b512f9c48b76f838615863e1d