Overview

overview

10

Static

static

0006c411fb...b2.exe

windows7-x64

8

0006c411fb...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0006c411fb8cebfb82ef3a13d66e00c82208d28b2e713ee3d67b6bc6aa1a2cb2

  • Size

    6.4MB

  • Sample

    221128-lw16nsea52

  • MD5

    4e818908bb2c826de0ed646c0c2aef92

  • SHA1

    7f26da24b93f5e25ebbfa01eb94b0daf744dd394

  • SHA256

    0006c411fb8cebfb82ef3a13d66e00c82208d28b2e713ee3d67b6bc6aa1a2cb2

  • SHA512

    5a499b9dd3b814cef468c16956e2a491561861c4dfc48138282a70087e5d7a889a9846b2a2eb49196c57c4a28818f445642f76fc7d6d5d077a924f1c0a248212

  • SSDEEP

    196608:hmCuV01GBI3J9/64s/w2VuFB7qcrFePLs9P5Z4:hMMP59/64tHRePsP5Z4

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      0006c411fb8cebfb82ef3a13d66e00c82208d28b2e713ee3d67b6bc6aa1a2cb2

    • Size

      6.4MB

    • MD5

      4e818908bb2c826de0ed646c0c2aef92

    • SHA1

      7f26da24b93f5e25ebbfa01eb94b0daf744dd394

    • SHA256

      0006c411fb8cebfb82ef3a13d66e00c82208d28b2e713ee3d67b6bc6aa1a2cb2

    • SHA512

      5a499b9dd3b814cef468c16956e2a491561861c4dfc48138282a70087e5d7a889a9846b2a2eb49196c57c4a28818f445642f76fc7d6d5d077a924f1c0a248212

    • SSDEEP

      196608:hmCuV01GBI3J9/64s/w2VuFB7qcrFePLs9P5Z4:hMMP59/64tHRePsP5Z4

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks