Overview
overview
7Static
static
3GreenLuma....er.zip
windows7-x64
1GreenLuma....er.zip
windows10-2004-x64
1GreenLuma....er.exe
windows7-x64
1GreenLuma....er.exe
windows10-2004-x64
1GreenLuma....er.exe
windows7-x64
7GreenLuma....er.exe
windows10-2004-x64
7main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3GreenLuma....on.dll
windows7-x64
1GreenLuma....on.dll
windows10-2004-x64
1GreenLuma....ME.txt
windows7-x64
1GreenLuma....ME.txt
windows10-2004-x64
1GreenLuma....on.ico
windows7-x64
3GreenLuma....on.ico
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 18:26
Behavioral task
behavioral1
Sample
GreenLuma.2020.Manager.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GreenLuma.2020.Manager.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
GreenLuma.2020.Manager/GL2020 Updater.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
GreenLuma.2020.Manager/GL2020 Updater.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
GreenLuma.2020.Manager/GreenLuma 2020 Manager.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
GreenLuma.2020.Manager/GreenLuma 2020 Manager.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
main.pyc
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
main.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
GreenLuma.2020.Manager/Newtonsoft.Json.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
GreenLuma.2020.Manager/Newtonsoft.Json.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
GreenLuma.2020.Manager/README.txt
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
GreenLuma.2020.Manager/README.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
GreenLuma.2020.Manager/icon.ico
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
GreenLuma.2020.Manager/icon.ico
Resource
win10v2004-20240611-en
General
-
Target
main.pyc
-
Size
734B
-
MD5
b5c2a5956a877d1fbba22f7a00ccf170
-
SHA1
951f2805ebce7cf71e2f85b34365a496dd65f81b
-
SHA256
06ad30e626f3d766b64967c4888ca9cedaacd27d8ae231df1d037320f7f6aa5c
-
SHA512
3a4c81b3e5e8b8b9e1a50f2b1180d75f61cfd2ba83fa0fa3790938476ebb2fc374cb4bf9a2895d1d2da73bad5661fe07644f805db0ccc109d82bbbc520017e6f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2432 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2432 AcroRd32.exe 2432 AcroRd32.exe 2432 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1972 wrote to memory of 2340 1972 cmd.exe rundll32.exe PID 1972 wrote to memory of 2340 1972 cmd.exe rundll32.exe PID 1972 wrote to memory of 2340 1972 cmd.exe rundll32.exe PID 2340 wrote to memory of 2432 2340 rundll32.exe AcroRd32.exe PID 2340 wrote to memory of 2432 2340 rundll32.exe AcroRd32.exe PID 2340 wrote to memory of 2432 2340 rundll32.exe AcroRd32.exe PID 2340 wrote to memory of 2432 2340 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5aa5def8d36cac1b70bce3f56b7b148f4
SHA1589f7dacfcf4b05f05dabd3a048450697645062c
SHA25681ac99421247c380a094a657fb1ef4af0044bc06e92498db513282afdc96091d
SHA5126c99dec5cfaeeb5c654cf7170f1ddfd11bf1d98880fee67eb3c730a787cb08af806ffda4135c19c1dcac09149aad7818ce562067b588449dc1781d430eedef7b