Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 02:11
Static task
static1
Behavioral task
behavioral1
Sample
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe
Resource
win10v2004-20221111-en
General
-
Target
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe
-
Size
193KB
-
MD5
d26216b074c217894eb57c1413983c17
-
SHA1
1dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
-
SHA256
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
-
SHA512
19cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5
-
SSDEEP
3072:PGfeC5RmS3LGpjPBX28Vz7Mj7eQnyzu5/1RXHHaDXqV3Td+SAU19sbh:PGfhmS3LejZ2KvOeNaXnxQUb
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
csrd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" csrd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\970228\\csrd.exe\"" csrd.exe -
Executes dropped EXE 2 IoCs
Processes:
csrd.execsrd.exepid process 1156 csrd.exe 1764 csrd.exe -
Loads dropped DLL 2 IoCs
Processes:
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exepid process 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
csrd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\csrdLink = "\"C:\\ProgramData\\970228\\csrd.exe\"" csrd.exe -
Drops file in System32 directory 2 IoCs
Processes:
csrd.exedescription ioc process File created C:\Windows\SysWOW64\clientsvr.exe csrd.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe csrd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.execsrd.exedescription pid process target process PID 1996 set thread context of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1156 set thread context of 1764 1156 csrd.exe csrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exepid process 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.execsrd.exedescription pid process Token: SeDebugPrivilege 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe Token: SeDebugPrivilege 1156 csrd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csrd.exepid process 1764 csrd.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.execsrd.exedescription pid process target process PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1996 wrote to memory of 1744 1996 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe PID 1744 wrote to memory of 1156 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe csrd.exe PID 1744 wrote to memory of 1156 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe csrd.exe PID 1744 wrote to memory of 1156 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe csrd.exe PID 1744 wrote to memory of 1156 1744 7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe PID 1156 wrote to memory of 1764 1156 csrd.exe csrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe"C:\Users\Admin\AppData\Local\Temp\7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe"C:\Users\Admin\AppData\Local\Temp\7b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\ProgramData\970228\csrd.exe"C:\ProgramData\970228\csrd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\ProgramData\970228\csrd.exe"C:\ProgramData\970228\csrd.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5d26216b074c217894eb57c1413983c17
SHA11dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
SHA2567b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
SHA51219cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5
-
Filesize
193KB
MD5d26216b074c217894eb57c1413983c17
SHA11dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
SHA2567b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
SHA51219cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5
-
Filesize
193KB
MD5d26216b074c217894eb57c1413983c17
SHA11dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
SHA2567b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
SHA51219cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5
-
Filesize
193KB
MD5d26216b074c217894eb57c1413983c17
SHA11dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
SHA2567b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
SHA51219cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5
-
Filesize
193KB
MD5d26216b074c217894eb57c1413983c17
SHA11dd2b4b7dc841f4bdc2e45b4485670f8fd107c79
SHA2567b8255fb2333e7a24017fb75314f56f946b15220ee6815f2444ee867c25e7d1e
SHA51219cc79de139fdcc01c9cebd61af2619f63b1606d3308cc25e9ac7e368fead021467136b7e3cf27dd18e81052ec66dc523f5e5ae3320002f03aa8213d9990e8a5