Analysis
-
max time kernel
169s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-11-2022 09:35
General
-
Target
77576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80.exe
-
Size
1.7MB
-
MD5
f6775963efac80285f8bd9ccf238e8e6
-
SHA1
c62b3116cd6be338f3a5c31c475440405971a213
-
SHA256
77576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80
-
SHA512
2df6ae13a2fadbd56973423c47f2bf59e0eb6aa1e809ca0779d5b088b824eaf3625a0f4899f87df338cf8389f11374f29cac1aa589edca54f7d98329f920e86f
-
SSDEEP
49152:XdPemCeUjRvBvaBEDYlHQE4eZY9oB21V4z:N2tekRclwDAYakaz
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80.exe"C:\Users\Admin\AppData\Local\Temp\77576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\mysqldt" /XML "C:\Users\Admin\AppData\Local\Temp\472046616.xml"2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\824800\mysqldt.exe"C:\ProgramData\824800\mysqldt.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5f6775963efac80285f8bd9ccf238e8e6
SHA1c62b3116cd6be338f3a5c31c475440405971a213
SHA25677576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80
SHA5122df6ae13a2fadbd56973423c47f2bf59e0eb6aa1e809ca0779d5b088b824eaf3625a0f4899f87df338cf8389f11374f29cac1aa589edca54f7d98329f920e86f
-
Filesize
1.7MB
MD5f6775963efac80285f8bd9ccf238e8e6
SHA1c62b3116cd6be338f3a5c31c475440405971a213
SHA25677576d4c908eb399228e2a00c6269714739195a3db63fb597f47fdf54df32b80
SHA5122df6ae13a2fadbd56973423c47f2bf59e0eb6aa1e809ca0779d5b088b824eaf3625a0f4899f87df338cf8389f11374f29cac1aa589edca54f7d98329f920e86f
-
Filesize
1KB
MD53a1127afadf300ddeb0e5f26221b023c
SHA1d1ea524fa61b1270569233510ee1f53cc6d7c1f5
SHA25693aba8c68dbbe83e19dbb58efc520dca81c62629856604249d8fc596e71ebff1
SHA5126b9519ef67168d684ccb289b0f38cadda255f00d3aec6b160cc69a013ba22deaab607c998a7708e9b9ecd3a5118d073f85ed74e16fa1c9ac351a7fa3f2e7a6e1
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB