Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
01-12-2023 15:18
General
-
Target
cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe
-
Size
1004KB
-
MD5
17f83bc21dfe5a240ffe81217f0d892f
-
SHA1
9f15af376dae479aa706555e5509322b018a99ba
-
SHA256
cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
-
SHA512
7490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
SSDEEP
24576:xE/NU3dLfFe1gAS0LE2ZKc9PSEH0uZuLfSA5yN4spZjpVcNTkJXo:EihxASPsaEH9ZuL3udKTW
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe"C:\Users\Admin\AppData\Local\Temp\cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe"C:\Users\Admin\AppData\Local\Temp\cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe"2⤵
- Luminosity
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "move up" /tr "'C:\Program Files (x86)\folder\cli.exe' /startup" /sc MINUTE /f /rl highest3⤵
- Luminosity
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "move up" /d "cmd /c """start """move up""" """C:\Program Files (x86)\folder\cli.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
-
-
C:\Program Files (x86)\folder\cli.exe"C:\Program Files (x86)\folder\cli.exe" /startup1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\folder\cli.exe"C:\Program Files (x86)\folder\cli.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\folder\cli.exe"C:\Program Files (x86)\folder\cli.exe" /startup1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\folder\cli.exe"C:\Program Files (x86)\folder\cli.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1004KB
MD517f83bc21dfe5a240ffe81217f0d892f
SHA19f15af376dae479aa706555e5509322b018a99ba
SHA256cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
SHA5127490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
Filesize
1004KB
MD517f83bc21dfe5a240ffe81217f0d892f
SHA19f15af376dae479aa706555e5509322b018a99ba
SHA256cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
SHA5127490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
Filesize
1004KB
MD517f83bc21dfe5a240ffe81217f0d892f
SHA19f15af376dae479aa706555e5509322b018a99ba
SHA256cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
SHA5127490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
Filesize
1004KB
MD517f83bc21dfe5a240ffe81217f0d892f
SHA19f15af376dae479aa706555e5509322b018a99ba
SHA256cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
SHA5127490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
Filesize
1004KB
MD517f83bc21dfe5a240ffe81217f0d892f
SHA19f15af376dae479aa706555e5509322b018a99ba
SHA256cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd
SHA5127490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979
-
Filesize
319B
MD5da4fafeffe21b7cb3a8c170ca7911976
SHA150ef77e2451ab60f93f4db88325b897d215be5ad
SHA2567341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
SHA5120bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
-
Filesize
499B
MD517f7e5c69c4f1dc984a9810dde3b6982
SHA1601b5cf990955dabd1693049c2ed13b9ee2d2bd9
SHA25688f6579fa5ec5ee4040bc0cc74ff0f95966ccfb0181342f51362c42cc10cee12
SHA512a48162a368d358fe99876d95f0389f07bcbe0f689b741db722d284dbb43dfdeccb0589cc64cb0bad379333bcdbb88c0d3fba7d419572216a219907e2cf501df1
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
880KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
880KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
5.7MB
-
Filesize
92KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB