Overview

overview

10

Static

static

141ed19ec1...e9.exe

windows7-x64

10

141ed19ec1...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    141ed19ec18802d3fc24038503e8c361a2653ae79935e3d7cda14172dbc43be9

  • Size

    504KB

  • Sample

    221126-yw32gsee4z

  • MD5

    442e1935e53619952a33090b4ba5aacd

  • SHA1

    f98168d3740aa39572457fdb18646167bc713030

  • SHA256

    141ed19ec18802d3fc24038503e8c361a2653ae79935e3d7cda14172dbc43be9

  • SHA512

    674f40dc2adb1a25d498c88a809fffcbd448119140d910a15fa535b97d8847a99942598b5f4a8622e4041abb4191e71fe7fba70f1966839a114b96d9722bfe36

  • SSDEEP

    12288:H9cXDP90RVcaVWjUhQuczopZCPgcLMGOe:HGXDP9WVHxpZggIMU

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      141ed19ec18802d3fc24038503e8c361a2653ae79935e3d7cda14172dbc43be9

    • Size

      504KB

    • MD5

      442e1935e53619952a33090b4ba5aacd

    • SHA1

      f98168d3740aa39572457fdb18646167bc713030

    • SHA256

      141ed19ec18802d3fc24038503e8c361a2653ae79935e3d7cda14172dbc43be9

    • SHA512

      674f40dc2adb1a25d498c88a809fffcbd448119140d910a15fa535b97d8847a99942598b5f4a8622e4041abb4191e71fe7fba70f1966839a114b96d9722bfe36

    • SSDEEP

      12288:H9cXDP90RVcaVWjUhQuczopZCPgcLMGOe:HGXDP9WVHxpZggIMU

    Score
    10/10
    persistenceluminosityrat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks