Analysis
-
max time kernel
119s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
01-02-2025 11:14
General
-
Target
6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
-
Size
3.2MB
-
MD5
f014e2750629f728dd4bf1ef3b7cde9a
-
SHA1
068ac0bb69f26f9b95a7cd71f74b41b587760e0a
-
SHA256
6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0
-
SHA512
b7539a11fdae3efc33a9dc65d4ebdff8ee41eac1a8793f20b76cc21c142c3c3536d6e9b8e9d4c7dd58d7c3470990d266185548a51a1e94776cee582025c5a935
-
SSDEEP
98304:vEpgwdMPzi3RRmiHMZ9X132hEHuAZwIqcyU2Tujn1i8NS1aU:MpgwdMPziLmiHCdYEKlTuj1iV
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Luminosity family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe"C:\Users\Admin\AppData\Local\Temp\6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[TempName].exe"C:\Users\Admin\AppData\Local\Temp\[TempName].exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3I5P0.tmp\[TempName].tmp"C:\Users\Admin\AppData\Local\Temp\is-3I5P0.tmp\[TempName].tmp" /SL5="$70066,2918001,69120,C:\Users\Admin\AppData\Local\Temp\[TempName].exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5f014e2750629f728dd4bf1ef3b7cde9a
SHA1068ac0bb69f26f9b95a7cd71f74b41b587760e0a
SHA2566d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0
SHA512b7539a11fdae3efc33a9dc65d4ebdff8ee41eac1a8793f20b76cc21c142c3c3536d6e9b8e9d4c7dd58d7c3470990d266185548a51a1e94776cee582025c5a935
-
Filesize
3.0MB
MD563736d5808289ec681461c5debb36cf9
SHA1d3e7c6b6de754786266f4b6e28eff442ff45937b
SHA2562a62fdd16aff304899eefad7c9135f1d5d482b3dfb7a8e248fa7b4b015eb89a2
SHA512fe28bd7a85f4adf90a3574aa774b43b86b74be3c4cfee8b7570abedcf925671042e3e3b8ba10e6108d454821286d35b4c7641426d29550e0fe90ba180d11f382
-
Filesize
703KB
MD51778c1f66ff205875a6435a33229ab3c
SHA15b6189159b16c6f85feed66834af3e06c0277a19
SHA25695c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA5128844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
312KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
92KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
92KB