luminosity | c9d5de176433cca42bfcf587e3d83d9e8947b895d0ec7c76d05bd8e892fc9572

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

scan-image2.exe
Size

1.2MB
MD5

82bd56d1562393f6fe6804679c757e39
SHA1

9f419cea26e9cfce290527a4671b3fc3a49c446d
SHA256

bdfb0d576f4f54f95a314462a84449b875e7130c89d44d37942c03b82f22d92f
SHA512

91908924f04b153ebb992a1b2aa935edceb07f2318c2ccf8a526a74c75448346c17502ae23ef956d6c6fbd881934e53565e6606d0ed918f04f6045c7aacd2714
SSDEEP

24576:pT3yU52y8rvkYzcUYGSvEoH/Ee/i/nNhzAv9nZ4pM:ZC20vkYzc00/Ee/i/DI9UM

Score

10^/10

luminosity discovery persistence rat

Malware Config

Signatures

Luminosity 3 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		scan-image2.exe
		3020	schtasks.exe
		4408	schtasks.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scan-image2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe
5004	scan-image2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5004	scan-image2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	scan-image2.exe
Token: SeDebugPrivilege	4336	client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	scan-image2.exe
4336	client.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3020	5004	scan-image2.exe	86
PID 5004 wrote to memory of 3020	5004	scan-image2.exe	86
PID 5004 wrote to memory of 3020	5004	scan-image2.exe	86
PID 5004 wrote to memory of 4664	5004	scan-image2.exe	102
PID 5004 wrote to memory of 4664	5004	scan-image2.exe	102
PID 5004 wrote to memory of 4664	5004	scan-image2.exe	102
PID 5004 wrote to memory of 4336	5004	scan-image2.exe	104
PID 5004 wrote to memory of 4336	5004	scan-image2.exe	104
PID 5004 wrote to memory of 4336	5004	scan-image2.exe	104
PID 5004 wrote to memory of 4336	5004	scan-image2.exe	104
PID 5004 wrote to memory of 4336	5004	scan-image2.exe	104
PID 4336 wrote to memory of 4408	4336	client.exe	105
PID 4336 wrote to memory of 4408	4336	client.exe	105
PID 4336 wrote to memory of 4408	4336	client.exe	105
PID 4336 wrote to memory of 4960	4336	client.exe	107
PID 4336 wrote to memory of 4960	4336	client.exe	107
PID 4336 wrote to memory of 4960	4336	client.exe	107

C:\Users\Admin\AppData\Local\Temp\scan-image2.exe
"C:\Users\Admin\AppData\Local\Temp\scan-image2.exe"
1⤵
- Luminosity
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
  2⤵
  - Luminosity
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4664

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
  2⤵
  - Luminosity
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4408
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
609b46a76cd48bb821b1f4893f40f1bc

SHA1
0a182f9b53fad50958702442a19760f5982a5d82

SHA256
5cc0d2dabe6b8816250c659f061774c6316d4d5c8e3c0b664954161cecf91c9c

SHA512
675cd91026d4b29731ef7da7188b357fd36a512d824f70a7fdf289a2a24cd2eba0ee155337f7ede359fd07c25801b984210728a632a3e4ac65dc73064a28f3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
471B

MD5
3f0c72d80da402da75333ce2eee6e822

SHA1
54974826b4c7c7ac213521f57c3e7d98e6de06df

SHA256
5fa4a6df15caeef2b33dc4a514ffbb5f719f32e6dd312b249c2d466b6b69295c

SHA512
457a18ed2484e392859eb3eea5ecfd35406407c826b3d6c75a4d6a511826f36c6096986b17be2aecc64f97c03d03abf8ccba5158185a429af4b7d763473b45ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
01aea4cdde044751dc25c3033a067ce4

SHA1
c702f333ec98e95a2c95264024553694c260120f

SHA256
d1fe7edcadf7c55fc7f2145288e10275e6e266cb981cd37f642aa796f0dbaef4

SHA512
afd0235007936f68e671d611a3f2eb2d0ee3caf19f67e62dff7c98dd1fe339b42091505da762a8058c459d035dd502cd2526293b5f398f7283c5b8d1cc76bfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
400B

MD5
9fd93e7b5c15aa790416261bec2439a0

SHA1
9ba4b20be045ee53fd7b226b0142b17aba231992

SHA256
694f35d63beb81977df4930e119e0e3429e648e2e4d01af13cfcb92382fabd93

SHA512
159c4f9c170c6839c803b9f2547f22727e0d83bcbb2d5c888dc02afafd5ddcc09529c6cdb97a648f3f44da1ceef841d65f7dfa7fefa8dbfb424638e813bacffa

Download Submit
memory/4336-23-0x0000000008A90000-0x0000000008A91000-memory.dmp

Filesize
4KB

Download
memory/4336-29-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-14-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-15-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-34-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-33-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-32-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-31-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-30-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-22-0x0000000005BD0000-0x0000000005BE7000-memory.dmp

Filesize
92KB

Download
memory/4336-21-0x0000000005BD0000-0x0000000005BE7000-memory.dmp

Filesize
92KB

Download
memory/4336-20-0x0000000005BD0000-0x0000000005BE7000-memory.dmp

Filesize
92KB

Download
memory/4336-24-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-27-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/4336-25-0x0000000005BD0000-0x0000000005BE7000-memory.dmp

Filesize
92KB

Download
memory/4336-28-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/5004-13-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/5004-0-0x0000000074D32000-0x0000000074D33000-memory.dmp

Filesize
4KB

Download
memory/5004-1-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/5004-2-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download
memory/5004-11-0x0000000074D32000-0x0000000074D33000-memory.dmp

Filesize
4KB

Download
memory/5004-12-0x0000000074D30000-0x00000000752E1000-memory.dmp

Filesize
5.7MB

Download