Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe
- Size 274KB
- Sample221127-cgmkasfe4x
- SHA256 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6
- MD5 bce901dc55c8d9b3983d0d38190ae26e
- SHA1 af1fae2a0f2b992f1b04ae168ea8a8fa45657c78
- SHA512 4928a93d885a173a52d67164972ebdcd5c5c1672ccbb65ab9376bda7066f2340c0e927fbfc864cc337cfce856d5d9576eda7da5be42eed11afcfd4d2ee37571d
- SSDEEP 6144:JBlZlxqoETDgmpDJ5GmXQ1v3cATekhjuy1n:JBl9qoETDgyPDQ1v3cKT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\318878\\sysmon.exe\"" sysmon.exe - Executes dropped EXE 2 IoCs
pid Process 3416 sysmon.exe 3308 sysmon.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\318878\\sysmon.exe\"" sysmon.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 796 set thread context of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 3416 set thread context of 3308 3416 sysmon.exe 84 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3416 sysmon.exe 3416 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe 3308 sysmon.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3252 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe Token: SeDebugPrivilege 3416 sysmon.exe Token: SeDebugPrivilege 3308 sysmon.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3308 sysmon.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 796 wrote to memory of 5028 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 80 PID 796 wrote to memory of 5028 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 80 PID 796 wrote to memory of 5028 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 80 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 796 wrote to memory of 3252 796 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 81 PID 3252 wrote to memory of 3416 3252 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 82 PID 3252 wrote to memory of 3416 3252 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 82 PID 3252 wrote to memory of 3416 3252 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe 82 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3416 wrote to memory of 3308 3416 sysmon.exe 84 PID 3308 wrote to memory of 3416 3308 sysmon.exe 82 PID 3308 wrote to memory of 3416 3308 sysmon.exe 82 PID 3308 wrote to memory of 3416 3308 sysmon.exe 82 PID 3308 wrote to memory of 3416 3308 sysmon.exe 82 PID 3308 wrote to memory of 3416 3308 sysmon.exe 82 PID 3308 wrote to memory of 796 3308 sysmon.exe 79 PID 3308 wrote to memory of 796 3308 sysmon.exe 79 PID 3308 wrote to memory of 796 3308 sysmon.exe 79 PID 3308 wrote to memory of 796 3308 sysmon.exe 79 PID 3308 wrote to memory of 796 3308 sysmon.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"2⤵PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"C:\Users\Admin\AppData\Local\Temp\72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6.exe"2⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\ProgramData\318878\sysmon.exe"C:\ProgramData\318878\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\ProgramData\318878\sysmon.exe"C:\ProgramData\318878\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\318878\sysmon.exe
- Size 274KB
- SHA256 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6
- MD5 bce901dc55c8d9b3983d0d38190ae26e
- SHA1 af1fae2a0f2b992f1b04ae168ea8a8fa45657c78
- SHA512 4928a93d885a173a52d67164972ebdcd5c5c1672ccbb65ab9376bda7066f2340c0e927fbfc864cc337cfce856d5d9576eda7da5be42eed11afcfd4d2ee37571d
- SSDEEP 6144:JBlZlxqoETDgmpDJ5GmXQ1v3cATekhjuy1n:JBl9qoETDgyPDQ1v3cKT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\318878\sysmon.exe
- Size 274KB
- SHA256 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6
- MD5 bce901dc55c8d9b3983d0d38190ae26e
- SHA1 af1fae2a0f2b992f1b04ae168ea8a8fa45657c78
- SHA512 4928a93d885a173a52d67164972ebdcd5c5c1672ccbb65ab9376bda7066f2340c0e927fbfc864cc337cfce856d5d9576eda7da5be42eed11afcfd4d2ee37571d
- SSDEEP 6144:JBlZlxqoETDgmpDJ5GmXQ1v3cATekhjuy1n:JBl9qoETDgyPDQ1v3cKT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\318878\sysmon.exe
- Size 274KB
- SHA256 72ddbf3882726aa33b02c2917d0ce987896801b7a70a6e220978b69fead7e7f6
- MD5 bce901dc55c8d9b3983d0d38190ae26e
- SHA1 af1fae2a0f2b992f1b04ae168ea8a8fa45657c78
- SHA512 4928a93d885a173a52d67164972ebdcd5c5c1672ccbb65ab9376bda7066f2340c0e927fbfc864cc337cfce856d5d9576eda7da5be42eed11afcfd4d2ee37571d
- SSDEEP 6144:JBlZlxqoETDgmpDJ5GmXQ1v3cATekhjuy1n:JBl9qoETDgyPDQ1v3cKT
- MD5 SHA1 SHA512 SSDEEP