Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 18:22

General

  • Target

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11.exe

  • Size

    349KB

  • MD5

    60eec175da96472e274f381336f2e953

  • SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

  • SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

  • SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • SSDEEP

    6144:/v+2p5fGOmQ2lBZnUnoJHwGYb3XFNCSbLnTZYJFpiNX85pRpp99k9T9s9s9:H+2p5pmQg5U6HCB5bzOFwd2pRpp99k9l

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11.exe
    "C:\Users\Admin\AppData\Local\Temp\f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11.exe
      "C:\Users\Admin\AppData\Local\Temp\f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:988
      • C:\ProgramData\224205\csrss.exe
        "C:\ProgramData\224205\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:592
        • C:\ProgramData\224205\csrss.exe
          "C:\ProgramData\224205\csrss.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\224205\csrss.exe

    Filesize

    349KB

    MD5

    60eec175da96472e274f381336f2e953

    SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

    SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

    SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • C:\ProgramData\224205\csrss.exe

    Filesize

    349KB

    MD5

    60eec175da96472e274f381336f2e953

    SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

    SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

    SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • C:\ProgramData\224205\csrss.exe

    Filesize

    349KB

    MD5

    60eec175da96472e274f381336f2e953

    SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

    SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

    SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • \ProgramData\224205\csrss.exe

    Filesize

    349KB

    MD5

    60eec175da96472e274f381336f2e953

    SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

    SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

    SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • \ProgramData\224205\csrss.exe

    Filesize

    349KB

    MD5

    60eec175da96472e274f381336f2e953

    SHA1

    3bf49fe29e8a17070594ab1df37d36c7d605576a

    SHA256

    f00480b1d8e9b860b77fc5fb64c5ecc3cde8ae3bfe8aa9bbdabe57da5633bc11

    SHA512

    3715091d4beb2e3903f4f5e2a37366d0c0d55e88d2aba78f4000d348fc31ef7936a9092fb716e8af10bcd9932b940e931a667f6cf8244ac7bfe9d8e34e519549

  • memory/592-92-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/592-76-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/636-94-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/636-90-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/988-67-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/988-57-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/988-75-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/988-58-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/988-60-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/988-65-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/988-91-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/988-93-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/988-62-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1032-54-0x0000000076711000-0x0000000076713000-memory.dmp

    Filesize

    8KB

  • memory/1032-56-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB

  • memory/1032-55-0x0000000074F00000-0x00000000754AB000-memory.dmp

    Filesize

    5.7MB