Analysis

  • max time kernel
    149s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 12:47

General

  • Target

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9.exe

  • Size

    263KB

  • MD5

    0933760192fb29d692ef0e037229e86d

  • SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

  • SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

  • SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • SSDEEP

    6144:Wve5lT+gycJHniGIGAigQtXopTPZTwqVOBCvDgi:W0Tu1G9BtXoBZrMBaDgi

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9.exe
    "C:\Users\Admin\AppData\Local\Temp\655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9.exe
      "C:\Users\Admin\AppData\Local\Temp\655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\ProgramData\338351\sysmon.exe
        "C:\ProgramData\338351\sysmon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\ProgramData\338351\sysmon.exe
          "C:\ProgramData\338351\sysmon.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\338351\sysmon.exe

    Filesize

    263KB

    MD5

    0933760192fb29d692ef0e037229e86d

    SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

    SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

    SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • C:\ProgramData\338351\sysmon.exe

    Filesize

    263KB

    MD5

    0933760192fb29d692ef0e037229e86d

    SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

    SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

    SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • C:\ProgramData\338351\sysmon.exe

    Filesize

    263KB

    MD5

    0933760192fb29d692ef0e037229e86d

    SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

    SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

    SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • \ProgramData\338351\sysmon.exe

    Filesize

    263KB

    MD5

    0933760192fb29d692ef0e037229e86d

    SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

    SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

    SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • \ProgramData\338351\sysmon.exe

    Filesize

    263KB

    MD5

    0933760192fb29d692ef0e037229e86d

    SHA1

    e9a323e9fd86d090e3e942060c7d809d7f0a6eee

    SHA256

    655c5fb5f5600963ef4d2d705b839e62be86ae03dc3e416a1feaa670b85dfaa9

    SHA512

    b7c733f0b5c02bfe61420dbb75a1c6cf57353b24c0853e07199cb89e3eebb1743df621779874ca6d1f00250c8a257e8b8b45bf4ee59a9bae5a8e3f7b0c4b52f0

  • memory/576-94-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/576-90-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1048-74-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1048-55-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/1368-92-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1368-76-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2008-59-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-75-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2008-56-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-57-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-61-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-66-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-91-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2008-64-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2008-93-0x0000000074A00000-0x0000000074FAB000-memory.dmp

    Filesize

    5.7MB