Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 17:12
Static task
static1
Behavioral task
behavioral1
Sample
7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe
Resource
win10v2004-20220812-en
General
-
Target
7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe
-
Size
403KB
-
MD5
12fab52166ca74beb58288c2beda1e86
-
SHA1
a84deca4453e5bd58b1cb23978d3f05a6d50fbdc
-
SHA256
7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081
-
SHA512
f4fb20486267185fafd6f5645b57b6997b4d19d6c5db41c957d2d419d1884d3b40137307d16c62ce24103434419441216feeb81fee722c65b418f27f7bf489ad
-
SSDEEP
6144:pXHB+V+i2eEGsklGFixqA/A3KEJMBpnjB85+vWeUOvsDpOX5aGBDic6:1miGXbx3/SMISOiB+7
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 5068 sysmon.exe 1188 sysmon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\105698\\sysmon.exe\"" sysmon.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysmon.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5100 set thread context of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5068 set thread context of 1188 5068 sysmon.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe 1188 sysmon.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1188 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1188 sysmon.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 5100 wrote to memory of 3208 5100 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 83 PID 3208 wrote to memory of 5068 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 84 PID 3208 wrote to memory of 5068 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 84 PID 3208 wrote to memory of 5068 3208 7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe 84 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 5068 wrote to memory of 1188 5068 sysmon.exe 85 PID 1188 wrote to memory of 3208 1188 sysmon.exe 83 PID 1188 wrote to memory of 3208 1188 sysmon.exe 83 PID 1188 wrote to memory of 3208 1188 sysmon.exe 83 PID 1188 wrote to memory of 3208 1188 sysmon.exe 83 PID 1188 wrote to memory of 3208 1188 sysmon.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe"C:\Users\Admin\AppData\Local\Temp\7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe"C:\Users\Admin\AppData\Local\Temp\7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\ProgramData\105698\sysmon.exe"C:\ProgramData\105698\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\ProgramData\105698\sysmon.exe"C:\ProgramData\105698\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
403KB
MD512fab52166ca74beb58288c2beda1e86
SHA1a84deca4453e5bd58b1cb23978d3f05a6d50fbdc
SHA2567da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081
SHA512f4fb20486267185fafd6f5645b57b6997b4d19d6c5db41c957d2d419d1884d3b40137307d16c62ce24103434419441216feeb81fee722c65b418f27f7bf489ad
-
Filesize
403KB
MD512fab52166ca74beb58288c2beda1e86
SHA1a84deca4453e5bd58b1cb23978d3f05a6d50fbdc
SHA2567da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081
SHA512f4fb20486267185fafd6f5645b57b6997b4d19d6c5db41c957d2d419d1884d3b40137307d16c62ce24103434419441216feeb81fee722c65b418f27f7bf489ad
-
Filesize
403KB
MD512fab52166ca74beb58288c2beda1e86
SHA1a84deca4453e5bd58b1cb23978d3f05a6d50fbdc
SHA2567da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081
SHA512f4fb20486267185fafd6f5645b57b6997b4d19d6c5db41c957d2d419d1884d3b40137307d16c62ce24103434419441216feeb81fee722c65b418f27f7bf489ad
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\7da9245a700f6545d3ecf786f990fff2396fed1cc5f73621f2b63599ca145081.exe.log
Filesize400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307