luminosity | 9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fd

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
Size

846KB
MD5

e3ca517e9b655d1072d7ddd0a08b71b0
SHA1

3bc6c35adf3d135ca63b7b31d9bb309bf0189f9e
SHA256

9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fd
SHA512

ce0b982d7c6643da46d85d15ff45df7a32b9b6c64fc5612e9d2f9664421c8390ab4d42bd33f25f98735ca3539c20931c80d3f28c9e3ee76557a2e42e35806107
SSDEEP

24576:jivDwwT8n0TawwU2hUsUyY8UgNkHN53e/J1XIqfPHhh5/cn5qVppW5NR/ctc0z1p:jivDwwT8n0TawwU2hUsUyY8UgNkHN53q

Score

10^/10

luminosity discovery persistence rat

Malware Config

Signatures

Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
rat luminosity
Luminosity family
luminosity

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\""	WinCOMHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\929123\\WinCOMHost.exe\""	WinCOMHost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe

Executes dropped EXE 2 IoCs

pid	Process
4360	WinCOMHost.exe
4892	WinCOMHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows COM Host = "\"C:\\ProgramData\\929123\\WinCOMHost.exe\""	WinCOMHost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\clientsvr.exe	WinCOMHost.exe
File opened for modification	C:\Windows\SysWOW64\clientsvr.exe	WinCOMHost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 4360 set thread context of 4892	4360	WinCOMHost.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinCOMHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinCOMHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe
4892	WinCOMHost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	WinCOMHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	WinCOMHost.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3516	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	84
PID 1124 wrote to memory of 3516	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	84
PID 1124 wrote to memory of 3516	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	84
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 1124 wrote to memory of 856	1124	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	85
PID 856 wrote to memory of 4360	856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	93
PID 856 wrote to memory of 4360	856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	93
PID 856 wrote to memory of 4360	856	9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe	93
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4360 wrote to memory of 4892	4360	WinCOMHost.exe	100
PID 4892 wrote to memory of 856	4892	WinCOMHost.exe	85
PID 4892 wrote to memory of 856	4892	WinCOMHost.exe	85
PID 4892 wrote to memory of 856	4892	WinCOMHost.exe	85
PID 4892 wrote to memory of 856	4892	WinCOMHost.exe	85
PID 4892 wrote to memory of 856	4892	WinCOMHost.exe	85

C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
"C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
  "C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe"
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe
  "C:\Users\Admin\AppData\Local\Temp\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\ProgramData\929123\WinCOMHost.exe
    "C:\ProgramData\929123\WinCOMHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\ProgramData\929123\WinCOMHost.exe
      "C:\ProgramData\929123\WinCOMHost.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\929123\WinCOMHost.exe

Filesize
846KB

MD5
e3ca517e9b655d1072d7ddd0a08b71b0

SHA1
3bc6c35adf3d135ca63b7b31d9bb309bf0189f9e

SHA256
9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fd

SHA512
ce0b982d7c6643da46d85d15ff45df7a32b9b6c64fc5612e9d2f9664421c8390ab4d42bd33f25f98735ca3539c20931c80d3f28c9e3ee76557a2e42e35806107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe.log

Filesize
312B

MD5
6dba4702b346903da02f7dd9e839a128

SHA1
d69f255866f30a87c9eca8312d425c47059bf15e

SHA256
29d145faac0201870c39b9119894f78694a776e03fc8f79349bdf92e56a65bcd

SHA512
33afef187e806838717238881aaaf41272f8b484fcfe97a85057fd43a7eeb119df813d6023d2ee770aa22a067f7e9d532dd1c30b512f9c48b76f838615863e1d

Download Submit
memory/856-42-0x0000000006960000-0x0000000006977000-memory.dmp

Filesize
92KB

Download
memory/856-5-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/856-28-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/856-47-0x0000000006960000-0x0000000006977000-memory.dmp

Filesize
92KB

Download
memory/856-44-0x0000000006960000-0x0000000006977000-memory.dmp

Filesize
92KB

Download
memory/856-11-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/856-12-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/856-10-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/856-40-0x0000000006960000-0x0000000006977000-memory.dmp

Filesize
92KB

Download
memory/856-43-0x0000000006980000-0x0000000006981000-memory.dmp

Filesize
4KB

Download
memory/856-48-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/856-4-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/856-41-0x0000000006960000-0x0000000006977000-memory.dmp

Filesize
92KB

Download
memory/1124-1-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/1124-0-0x00000000752A2000-0x00000000752A3000-memory.dmp

Filesize
4KB

Download
memory/1124-2-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/1124-9-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4360-26-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4360-36-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4360-27-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4892-37-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4892-46-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download