Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 08:13

General

  • Target

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe

  • Size

    452KB

  • MD5

    d94071cc7092986d52903d1443421aeb

  • SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

  • SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

  • SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • SSDEEP

    12288:tdOKIut/dpyKpxi2A/AQDWYs7Is+uMpu4x:D7t/dpni4QGIE2u

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe
    "C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe
      "C:\Users\Admin\AppData\Local\Temp\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\ProgramData\294640\vbc.exe
        "C:\ProgramData\294640\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\ProgramData\294640\vbc.exe
          "C:\ProgramData\294640\vbc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\294640\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • C:\ProgramData\294640\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • C:\ProgramData\294640\vbc.exe

    Filesize

    452KB

    MD5

    d94071cc7092986d52903d1443421aeb

    SHA1

    45d4f98b528d7c2820d98da77e4c564f03c426e3

    SHA256

    51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05

    SHA512

    66f232361bb7549124fe6b7a962b33518e3a73c1480f11bac695b12c9d7515a067cd87dfbaafa84321c7ee851c70b60b040a212073c36f45267eb6cf33495577

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\51e5d9df867d1e8eab396d01821398748393968f62992cfe94da48b3b2008a05.exe.log

    Filesize

    496B

    MD5

    cb76b18ebed3a9f05a14aed43d35fba6

    SHA1

    836a4b4e351846fca08b84149cb734cb59b8c0d6

    SHA256

    8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

    SHA512

    7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

  • memory/1748-143-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/1748-150-0x00000000067A0000-0x00000000067B7000-memory.dmp

    Filesize

    92KB

  • memory/1748-153-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/1748-152-0x00000000067A0000-0x00000000067B7000-memory.dmp

    Filesize

    92KB

  • memory/1748-138-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/1748-151-0x00000000067A0000-0x00000000067B7000-memory.dmp

    Filesize

    92KB

  • memory/2180-142-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-148-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-144-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/3608-146-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/3608-149-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/3608-154-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/5064-133-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/5064-132-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB

  • memory/5064-137-0x0000000074AC0000-0x0000000075071000-memory.dmp

    Filesize

    5.7MB