luminosity | 6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2025, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
Size

3.2MB
MD5

f014e2750629f728dd4bf1ef3b7cde9a
SHA1

068ac0bb69f26f9b95a7cd71f74b41b587760e0a
SHA256

6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0
SHA512

b7539a11fdae3efc33a9dc65d4ebdff8ee41eac1a8793f20b76cc21c142c3c3536d6e9b8e9d4c7dd58d7c3470990d266185548a51a1e94776cee582025c5a935
SSDEEP

98304:vEpgwdMPzi3RRmiHMZ9X132hEHuAZwIqcyU2Tujn1i8NS1aU:MpgwdMPziLmiHCdYEKlTuj1iV

Score

10^/10

luminosity discovery persistence rat

Malware Config

Signatures

Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
rat luminosity
Luminosity family
luminosity

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\100375\\sysmon.exe\""	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientmonitor.exe\""	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\International\Geo\Nation	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Executes dropped EXE 2 IoCs

pid	Process
2376	[TempName].exe
736	[TempName].tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\clientmonitor.exe	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[TempName].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[TempName].tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
736	[TempName].tmp
736	[TempName].tmp
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2376	[TempName].exe
2376	[TempName].exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2376 wrote to memory of 736	2376	[TempName].exe	87
PID 2376 wrote to memory of 736	2376	[TempName].exe	87
PID 2376 wrote to memory of 736	2376	[TempName].exe	87
PID 2404 wrote to memory of 736	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	87
PID 2404 wrote to memory of 736	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	87
PID 2404 wrote to memory of 736	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	87
PID 2404 wrote to memory of 736	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	87
PID 2404 wrote to memory of 736	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	87
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86
PID 2404 wrote to memory of 2376	2404	6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe	86

C:\Users\Admin\AppData\Local\Temp\6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe
"C:\Users\Admin\AppData\Local\Temp\6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\[TempName].exe
  "C:\Users\Admin\AppData\Local\Temp\[TempName].exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\is-OBLUU.tmp\[TempName].tmp
    "C:\Users\Admin\AppData\Local\Temp\is-OBLUU.tmp\[TempName].tmp" /SL5="$900D8,2918001,69120,C:\Users\Admin\AppData\Local\Temp\[TempName].exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\100375\sysmon.exe

Filesize
3.2MB

MD5
f014e2750629f728dd4bf1ef3b7cde9a

SHA1
068ac0bb69f26f9b95a7cd71f74b41b587760e0a

SHA256
6d7f105a5db2829c3e240341df88927c014a8c3899b106ebd16bc791b44406f0

SHA512
b7539a11fdae3efc33a9dc65d4ebdff8ee41eac1a8793f20b76cc21c142c3c3536d6e9b8e9d4c7dd58d7c3470990d266185548a51a1e94776cee582025c5a935

Download Submit
C:\Users\Admin\AppData\Local\Temp\[TempName].exe

Filesize
3.0MB

MD5
63736d5808289ec681461c5debb36cf9

SHA1
d3e7c6b6de754786266f4b6e28eff442ff45937b

SHA256
2a62fdd16aff304899eefad7c9135f1d5d482b3dfb7a8e248fa7b4b015eb89a2

SHA512
fe28bd7a85f4adf90a3574aa774b43b86b74be3c4cfee8b7570abedcf925671042e3e3b8ba10e6108d454821286d35b4c7641426d29550e0fe90ba180d11f382

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OBLUU.tmp\[TempName].tmp

Filesize
703KB

MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
memory/736-58-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-64-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-136-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-130-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-118-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-112-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-106-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-100-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-94-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-26-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-88-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-82-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-76-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-40-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/736-37-0x00000000030E0000-0x00000000030F7000-memory.dmp

Filesize
92KB

Download
memory/736-42-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-70-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/736-39-0x00000000030E0000-0x00000000030F7000-memory.dmp

Filesize
92KB

Download
memory/736-38-0x00000000030E0000-0x00000000030F7000-memory.dmp

Filesize
92KB

Download
memory/736-43-0x00000000030E0000-0x00000000030F7000-memory.dmp

Filesize
92KB

Download
memory/736-54-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2376-47-0x0000000002730000-0x0000000002747000-memory.dmp

Filesize
92KB

Download
memory/2376-46-0x0000000002730000-0x0000000002747000-memory.dmp

Filesize
92KB

Download
memory/2376-45-0x0000000002730000-0x0000000002747000-memory.dmp

Filesize
92KB

Download
memory/2376-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2376-48-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/2376-19-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2376-49-0x0000000002730000-0x0000000002747000-memory.dmp

Filesize
92KB

Download
memory/2376-41-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2404-35-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2404-4-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2404-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/2404-36-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/2404-2-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/2404-22-0x00000000073A0000-0x0000000007432000-memory.dmp

Filesize
584KB

Download
memory/2404-21-0x0000000007090000-0x00000000070F6000-memory.dmp

Filesize
408KB

Download
memory/2404-18-0x0000000006F80000-0x000000000701C000-memory.dmp

Filesize
624KB

Download
memory/2404-1-0x0000000000090000-0x00000000003CA000-memory.dmp

Filesize
3.2MB

Download
memory/2404-34-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/2404-15-0x0000000004E00000-0x0000000004E4E000-memory.dmp

Filesize
312KB

Download