Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 21:37
Static task
static1
Behavioral task
behavioral1
Sample
90a29c1557da252f6bce8f51f9b14cec.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
90a29c1557da252f6bce8f51f9b14cec.exe
Resource
win10v2004-20231215-en
General
-
Target
90a29c1557da252f6bce8f51f9b14cec.exe
-
Size
131KB
-
MD5
90a29c1557da252f6bce8f51f9b14cec
-
SHA1
d53ae23fe237acee3ee617d69c7a3aac9a5ef1d2
-
SHA256
0527f5a56def0e5dd5efa5ff5316549388266afbf11a40103569b05c6af37e0f
-
SHA512
7fdb536fe53d176b505c7bc33322328cc612af8e3d5b5e130abc9f9475642cae2872e1422c0e63a5503e2541ac687d000b0940bae3a9204ea17ba0c3ca6d7e77
-
SSDEEP
3072:MmAxAF6BovnUJueps41dhL7JvQS7oPKinu9oF:MmuAFaMUvCId5F/7IGe
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Executes dropped EXE 1 IoCs
Processes:
GetSummonersName.exepid process 2804 GetSummonersName.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2692 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
90a29c1557da252f6bce8f51f9b14cec.exedescription pid process target process PID 2320 set thread context of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
90a29c1557da252f6bce8f51f9b14cec.exepid process 2320 90a29c1557da252f6bce8f51f9b14cec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
90a29c1557da252f6bce8f51f9b14cec.exeGetSummonersName.exedescription pid process Token: SeDebugPrivilege 2320 90a29c1557da252f6bce8f51f9b14cec.exe Token: SeDebugPrivilege 2804 GetSummonersName.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
90a29c1557da252f6bce8f51f9b14cec.exepid process 2824 90a29c1557da252f6bce8f51f9b14cec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
90a29c1557da252f6bce8f51f9b14cec.execmd.exedescription pid process target process PID 2320 wrote to memory of 2692 2320 90a29c1557da252f6bce8f51f9b14cec.exe cmd.exe PID 2320 wrote to memory of 2692 2320 90a29c1557da252f6bce8f51f9b14cec.exe cmd.exe PID 2320 wrote to memory of 2692 2320 90a29c1557da252f6bce8f51f9b14cec.exe cmd.exe PID 2320 wrote to memory of 2692 2320 90a29c1557da252f6bce8f51f9b14cec.exe cmd.exe PID 2692 wrote to memory of 2804 2692 cmd.exe GetSummonersName.exe PID 2692 wrote to memory of 2804 2692 cmd.exe GetSummonersName.exe PID 2692 wrote to memory of 2804 2692 cmd.exe GetSummonersName.exe PID 2692 wrote to memory of 2804 2692 cmd.exe GetSummonersName.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2824 2320 90a29c1557da252f6bce8f51f9b14cec.exe 90a29c1557da252f6bce8f51f9b14cec.exe PID 2320 wrote to memory of 2572 2320 90a29c1557da252f6bce8f51f9b14cec.exe schtasks.exe PID 2320 wrote to memory of 2572 2320 90a29c1557da252f6bce8f51f9b14cec.exe schtasks.exe PID 2320 wrote to memory of 2572 2320 90a29c1557da252f6bce8f51f9b14cec.exe schtasks.exe PID 2320 wrote to memory of 2572 2320 90a29c1557da252f6bce8f51f9b14cec.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90a29c1557da252f6bce8f51f9b14cec.exe"C:\Users\Admin\AppData\Local\Temp\90a29c1557da252f6bce8f51f9b14cec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\GetSummonersName.exe" & exit2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Roaming\GetSummonersName.exe"C:\Users\Admin\AppData\Roaming\GetSummonersName.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\90a29c1557da252f6bce8f51f9b14cec.exe"C:\Users\Admin\AppData\Local\Temp\90a29c1557da252f6bce8f51f9b14cec.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2824 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\SinkDropper Utility" /XML "C:\Users\Admin\AppData\Roaming\ezcgi.xml"2⤵
- Creates scheduled task(s)
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2320-0-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2320-2-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/2320-1-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2320-48-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2320-43-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/2320-42-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/2320-41-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2804-49-0x00000000715A0000-0x0000000071C8E000-memory.dmpFilesize
6.9MB
-
memory/2804-47-0x00000000715A0000-0x0000000071C8E000-memory.dmpFilesize
6.9MB
-
memory/2804-39-0x0000000000070000-0x0000000000078000-memory.dmpFilesize
32KB
-
memory/2804-40-0x00000000715A0000-0x0000000071C8E000-memory.dmpFilesize
6.9MB
-
memory/2824-16-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-20-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2824-26-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-33-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2824-34-0x0000000000650000-0x0000000000690000-memory.dmpFilesize
256KB
-
memory/2824-35-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2824-44-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2824-46-0x0000000000650000-0x0000000000690000-memory.dmpFilesize
256KB
-
memory/2824-45-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/2824-28-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-30-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-18-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB