Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe
- Size 377KB
- Sample221127-cs4yqacf63
- SHA256 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3
- MD5 8ce45883f980e710f06db6d27de1ad16
- SHA1 6cfcb86e722378b8c865aeda80ef4e19d1fe6cd3
- SHA512 165a916be6cabb6e81e57813e5d070c80c0d9f286c2d94ef75eaae4f460b1a3aadadd33f663b5731918becc8c54b0b9d9da46a26cca30e06aa17469db22511ea
- SSDEEP 6144:4qMcs/gIn3iSNRHmjEZvQt9mH983R5ddOuX4y7YFyU9b1w1XSrM:4qM7/gUXGjHE8hPMuXRsFy85w1SrM
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\125854\\sysmon.exe\"" sysmon.exe - Executes dropped EXE 3 IoCs
pid Process 372 sysmon.exe 1712 sysmon.exe 2412 sysmon.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System main = "\"C:\\ProgramData\\125854\\sysmon.exe\"" sysmon.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4896 set thread context of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 372 set thread context of 2412 372 sysmon.exe 85 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 372 sysmon.exe 372 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 372 sysmon.exe 372 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe 2412 sysmon.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe Token: SeDebugPrivilege 372 sysmon.exe Token: SeDebugPrivilege 2412 sysmon.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2412 sysmon.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4896 wrote to memory of 4752 4896 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 82 PID 4752 wrote to memory of 372 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 83 PID 4752 wrote to memory of 372 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 83 PID 4752 wrote to memory of 372 4752 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe 83 PID 372 wrote to memory of 1712 372 sysmon.exe 84 PID 372 wrote to memory of 1712 372 sysmon.exe 84 PID 372 wrote to memory of 1712 372 sysmon.exe 84 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 372 wrote to memory of 2412 372 sysmon.exe 85 PID 2412 wrote to memory of 372 2412 sysmon.exe 83 PID 2412 wrote to memory of 372 2412 sysmon.exe 83 PID 2412 wrote to memory of 372 2412 sysmon.exe 83 PID 2412 wrote to memory of 372 2412 sysmon.exe 83 PID 2412 wrote to memory of 372 2412 sysmon.exe 83 PID 2412 wrote to memory of 4896 2412 sysmon.exe 80 PID 2412 wrote to memory of 4896 2412 sysmon.exe 80 PID 2412 wrote to memory of 4896 2412 sysmon.exe 80 PID 2412 wrote to memory of 4896 2412 sysmon.exe 80 PID 2412 wrote to memory of 4896 2412 sysmon.exe 80 PID 2412 wrote to memory of 4752 2412 sysmon.exe 82 PID 2412 wrote to memory of 4752 2412 sysmon.exe 82 PID 2412 wrote to memory of 4752 2412 sysmon.exe 82 PID 2412 wrote to memory of 4752 2412 sysmon.exe 82 PID 2412 wrote to memory of 4752 2412 sysmon.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe"C:\Users\Admin\AppData\Local\Temp\cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe"C:\Users\Admin\AppData\Local\Temp\cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\ProgramData\125854\sysmon.exe"C:\ProgramData\125854\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\ProgramData\125854\sysmon.exe"C:\ProgramData\125854\sysmon.exe"4⤵
- Executes dropped EXE
PID:1712
-
-
C:\ProgramData\125854\sysmon.exe"C:\ProgramData\125854\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\125854\sysmon.exe
- Size 377KB
- SHA256 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3
- MD5 8ce45883f980e710f06db6d27de1ad16
- SHA1 6cfcb86e722378b8c865aeda80ef4e19d1fe6cd3
- SHA512 165a916be6cabb6e81e57813e5d070c80c0d9f286c2d94ef75eaae4f460b1a3aadadd33f663b5731918becc8c54b0b9d9da46a26cca30e06aa17469db22511ea
- SSDEEP 6144:4qMcs/gIn3iSNRHmjEZvQt9mH983R5ddOuX4y7YFyU9b1w1XSrM:4qM7/gUXGjHE8hPMuXRsFy85w1SrM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\125854\sysmon.exe
- Size 377KB
- SHA256 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3
- MD5 8ce45883f980e710f06db6d27de1ad16
- SHA1 6cfcb86e722378b8c865aeda80ef4e19d1fe6cd3
- SHA512 165a916be6cabb6e81e57813e5d070c80c0d9f286c2d94ef75eaae4f460b1a3aadadd33f663b5731918becc8c54b0b9d9da46a26cca30e06aa17469db22511ea
- SSDEEP 6144:4qMcs/gIn3iSNRHmjEZvQt9mH983R5ddOuX4y7YFyU9b1w1XSrM:4qM7/gUXGjHE8hPMuXRsFy85w1SrM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\125854\sysmon.exe
- Size 377KB
- SHA256 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3
- MD5 8ce45883f980e710f06db6d27de1ad16
- SHA1 6cfcb86e722378b8c865aeda80ef4e19d1fe6cd3
- SHA512 165a916be6cabb6e81e57813e5d070c80c0d9f286c2d94ef75eaae4f460b1a3aadadd33f663b5731918becc8c54b0b9d9da46a26cca30e06aa17469db22511ea
- SSDEEP 6144:4qMcs/gIn3iSNRHmjEZvQt9mH983R5ddOuX4y7YFyU9b1w1XSrM:4qM7/gUXGjHE8hPMuXRsFy85w1SrM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\125854\sysmon.exe
- Size 377KB
- SHA256 cf68868443b4d475c282846c7d8945442825e91ad42ef5b384ddb777ff5c68c3
- MD5 8ce45883f980e710f06db6d27de1ad16
- SHA1 6cfcb86e722378b8c865aeda80ef4e19d1fe6cd3
- SHA512 165a916be6cabb6e81e57813e5d070c80c0d9f286c2d94ef75eaae4f460b1a3aadadd33f663b5731918becc8c54b0b9d9da46a26cca30e06aa17469db22511ea
- SSDEEP 6144:4qMcs/gIn3iSNRHmjEZvQt9mH983R5ddOuX4y7YFyU9b1w1XSrM:4qM7/gUXGjHE8hPMuXRsFy85w1SrM
- MD5 SHA1 SHA512 SSDEEP