Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 20:36
Static task
static1
Behavioral task
behavioral1
Sample
5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe
Resource
win10v2004-20220901-en
General
-
Target
5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe
-
Size
363KB
-
MD5
407ad0b8ca4c0d6fdf45497b6e5e91b3
-
SHA1
b904a4b9b05ff476c14b1c3dd1de55c7cbab0654
-
SHA256
5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383
-
SHA512
32c2f382b19298cf4e6978c44a09a33bb9ee0912d89ebf0138139f1618f3e8640474c78a97f3815dea4f740c177ef809efbf2a6d45e9588958d3fa7a654c9b98
-
SSDEEP
6144:w8i2UsvYzQGvK28szYvU4n2kJBbnCtfhCyZx+LFus/pT7ivqqqXASDLNVJ6i:G2UsJwKqc4krDCtZxGFusxwqqMLXAi
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" helper.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\231036\\helper.exe\"" helper.exe -
Executes dropped EXE 2 IoCs
pid Process 1496 helper.exe 552 helper.exe -
Loads dropped DLL 1 IoCs
pid Process 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\PS3ai2RI4Cc31t0n = "C:\\Users\\Admin\\AppData\\Roaming\\VcBMrGX0F13ago17\\nQuZ3ENlEZBr.exe" 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\PS3ai2RI4Cc31t0nLF = "C:\\Users\\Admin\\AppData\\Roaming\\VcBMrGX0F13ago17\\zHdsCKEBCAdd.exe" helper.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Computer Helper = "\"C:\\ProgramData\\231036\\helper.exe\"" helper.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe helper.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe helper.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1100 set thread context of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1496 set thread context of 552 1496 helper.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 1496 helper.exe 1496 helper.exe 552 helper.exe 552 helper.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe Token: SeDebugPrivilege 1496 helper.exe Token: SeDebugPrivilege 552 helper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 552 helper.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1872 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 27 PID 1100 wrote to memory of 1872 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 27 PID 1100 wrote to memory of 1872 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 27 PID 1100 wrote to memory of 1872 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 27 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1100 wrote to memory of 1820 1100 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 28 PID 1820 wrote to memory of 1496 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 30 PID 1820 wrote to memory of 1496 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 30 PID 1820 wrote to memory of 1496 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 30 PID 1820 wrote to memory of 1496 1820 5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe 30 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31 PID 1496 wrote to memory of 552 1496 helper.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"2⤵PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"C:\Users\Admin\AppData\Local\Temp\5afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\ProgramData\231036\helper.exe"C:\ProgramData\231036\helper.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\ProgramData\231036\helper.exe"C:\ProgramData\231036\helper.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:552
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD5407ad0b8ca4c0d6fdf45497b6e5e91b3
SHA1b904a4b9b05ff476c14b1c3dd1de55c7cbab0654
SHA2565afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383
SHA51232c2f382b19298cf4e6978c44a09a33bb9ee0912d89ebf0138139f1618f3e8640474c78a97f3815dea4f740c177ef809efbf2a6d45e9588958d3fa7a654c9b98
-
Filesize
363KB
MD5407ad0b8ca4c0d6fdf45497b6e5e91b3
SHA1b904a4b9b05ff476c14b1c3dd1de55c7cbab0654
SHA2565afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383
SHA51232c2f382b19298cf4e6978c44a09a33bb9ee0912d89ebf0138139f1618f3e8640474c78a97f3815dea4f740c177ef809efbf2a6d45e9588958d3fa7a654c9b98
-
Filesize
363KB
MD5407ad0b8ca4c0d6fdf45497b6e5e91b3
SHA1b904a4b9b05ff476c14b1c3dd1de55c7cbab0654
SHA2565afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383
SHA51232c2f382b19298cf4e6978c44a09a33bb9ee0912d89ebf0138139f1618f3e8640474c78a97f3815dea4f740c177ef809efbf2a6d45e9588958d3fa7a654c9b98
-
Filesize
363KB
MD5407ad0b8ca4c0d6fdf45497b6e5e91b3
SHA1b904a4b9b05ff476c14b1c3dd1de55c7cbab0654
SHA2565afacb39e2b3de26c60c6c4e96cf172dd952e20e7b081dd498a7157d8cb99383
SHA51232c2f382b19298cf4e6978c44a09a33bb9ee0912d89ebf0138139f1618f3e8640474c78a97f3815dea4f740c177ef809efbf2a6d45e9588958d3fa7a654c9b98