luminosity | 6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea

General

Target

6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe
Size

365KB
MD5

d31534e5cad8165303712679ec3c6fd2
SHA1

4fbf5a16f467108beff8d906d0df1d441bd0168f
SHA256

6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea
SHA512

894d22ca37856713c01c5a1b5287ee8a85b46bd1f8f813c8def7dee4eb1b06f7963ce15e90906c6062f6c8c20a1e293177b6efe30efc9d15d942af8276d35465
SSDEEP

6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWnlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvEhla2P4brEyjk7ngYsP

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
rat luminosity

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

sysmon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\""	sysmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\604256\\sysmon.exe\""	sysmon.exe

Executes dropped EXE 1 IoCs

Processes:

sysmon.exe

pid process

1820 sysmon.exe

pid	process
1820	sysmon.exe

Loads dropped DLL 2 IoCs

Processes:

6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe

pid	process
520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe
520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sysmon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\604256\\sysmon.exe\""	sysmon.exe

Drops file in System32 directory 2 IoCs

Processes:

sysmon.exe

description ioc process

File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe
File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

sysmon.exe

pid process

1820 sysmon.exe
1820 sysmon.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe

pid process

520 6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

sysmon.exe

description pid process

Token: SeDebugPrivilege 1820 sysmon.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

sysmon.exe

pid process

1820 sysmon.exe

description	ioc	process
File created	C:\Windows\SysWOW64\clientsvr.exe	sysmon.exe
File opened for modification	C:\Windows\SysWOW64\clientsvr.exe	sysmon.exe

pid	process
1820	sysmon.exe
1820	sysmon.exe

description	pid	process
Token: SeDebugPrivilege	1820	sysmon.exe

pid	process
1820	sysmon.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe

description	pid	process	target process
PID 520 wrote to memory of 1820	520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe	sysmon.exe
PID 520 wrote to memory of 1820	520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe	sysmon.exe
PID 520 wrote to memory of 1820	520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe	sysmon.exe
PID 520 wrote to memory of 1820	520	6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe	sysmon.exe

C:\Users\Admin\AppData\Local\Temp\6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe
"C:\Users\Admin\AppData\Local\Temp\6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:520
- C:\ProgramData\604256\sysmon.exe
  "C:\ProgramData\604256\sysmon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\604256\sysmon.exe

Filesize
365KB

MD5
d31534e5cad8165303712679ec3c6fd2

SHA1
4fbf5a16f467108beff8d906d0df1d441bd0168f

SHA256
6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea

SHA512
894d22ca37856713c01c5a1b5287ee8a85b46bd1f8f813c8def7dee4eb1b06f7963ce15e90906c6062f6c8c20a1e293177b6efe30efc9d15d942af8276d35465

Download Submit
C:\ProgramData\604256\sysmon.exe

Filesize
365KB

MD5
d31534e5cad8165303712679ec3c6fd2

SHA1
4fbf5a16f467108beff8d906d0df1d441bd0168f

SHA256
6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea

SHA512
894d22ca37856713c01c5a1b5287ee8a85b46bd1f8f813c8def7dee4eb1b06f7963ce15e90906c6062f6c8c20a1e293177b6efe30efc9d15d942af8276d35465

Download Submit
\ProgramData\604256\sysmon.exe

Filesize
365KB

MD5
d31534e5cad8165303712679ec3c6fd2

SHA1
4fbf5a16f467108beff8d906d0df1d441bd0168f

SHA256
6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea

SHA512
894d22ca37856713c01c5a1b5287ee8a85b46bd1f8f813c8def7dee4eb1b06f7963ce15e90906c6062f6c8c20a1e293177b6efe30efc9d15d942af8276d35465

Download Submit
\ProgramData\604256\sysmon.exe

Filesize
365KB

MD5
d31534e5cad8165303712679ec3c6fd2

SHA1
4fbf5a16f467108beff8d906d0df1d441bd0168f

SHA256
6d54603de1c5e1deaea0f02f0fdc7e9c6199170e5d056499fd5fe37746de13ea

SHA512
894d22ca37856713c01c5a1b5287ee8a85b46bd1f8f813c8def7dee4eb1b06f7963ce15e90906c6062f6c8c20a1e293177b6efe30efc9d15d942af8276d35465

Download Submit
memory/520-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/520-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/520-63-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/520-65-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-58-0x0000000000000000-mapping.dmp

Download
memory/1820-62-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-64-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads