Analysis

  • max time kernel
    147s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 08:13

General

  • Target

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe

  • Size

    452KB

  • MD5

    d94071cc7092986d52903d1443421aeb

  • SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

  • SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

  • SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • SSDEEP

    12288:tdOKIut/dpyKpxi2A/AQDWYs7Is+uMpu4x:D7t/dpni4QGIE2u

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe
    "C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe
      "C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\ProgramData\691325\vbc.exe
        "C:\ProgramData\691325\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\ProgramData\691325\vbc.exe
          "C:\ProgramData\691325\vbc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\691325\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • C:\ProgramData\691325\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • C:\ProgramData\691325\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • \ProgramData\691325\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • memory/1156-80-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1156-61-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-63-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-108-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1156-66-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-68-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-106-0x0000000004570000-0x0000000004587000-memory.dmp

    Filesize

    92KB

  • memory/1156-59-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-72-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1156-58-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1156-97-0x0000000004570000-0x0000000004587000-memory.dmp

    Filesize

    92KB

  • memory/1156-98-0x0000000004570000-0x0000000004587000-memory.dmp

    Filesize

    92KB

  • memory/1156-100-0x0000000004570000-0x0000000004587000-memory.dmp

    Filesize

    92KB

  • memory/1156-103-0x0000000004570000-0x0000000004587000-memory.dmp

    Filesize

    92KB

  • memory/1448-71-0x0000000000236000-0x0000000000247000-memory.dmp

    Filesize

    68KB

  • memory/1448-55-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

    Filesize

    8KB

  • memory/1448-70-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1448-57-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1448-56-0x0000000000236000-0x0000000000247000-memory.dmp

    Filesize

    68KB

  • memory/1616-78-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1616-79-0x0000000000BF6000-0x0000000000C07000-memory.dmp

    Filesize

    68KB

  • memory/1616-92-0x0000000000BF6000-0x0000000000C07000-memory.dmp

    Filesize

    68KB

  • memory/1616-91-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1616-81-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1684-107-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/1684-109-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB