Analysis
-
max time kernel
120s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
02-02-2025 06:36
General
-
Target
778c1b98f4ed5c0d101e3b52cee35b9a01f89f73bffcd3775d66f51c95b88df1N.exe
-
Size
3.2MB
-
MD5
1c7b4c1d054aa7ada5559d79df05a030
-
SHA1
cae730040d5121128047d2ec8086423609a04beb
-
SHA256
778c1b98f4ed5c0d101e3b52cee35b9a01f89f73bffcd3775d66f51c95b88df1
-
SHA512
9f57ea74f06a7477ac58c0519b1616c497eb151af45863f0c1e29be20260dea9bbd306b16728724a0e4a0a2c8b717bdbf0a94755ba8e8f9c6440c327764aa474
-
SSDEEP
98304:vEpgwdMPzi3RRmiHMZ9X132hEHuAZwIqcyU2Tujn1i8NS1aU:MpgwdMPziLmiHCdYEKlTuj1iF
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Luminosity family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\778c1b98f4ed5c0d101e3b52cee35b9a01f89f73bffcd3775d66f51c95b88df1N.exe"C:\Users\Admin\AppData\Local\Temp\778c1b98f4ed5c0d101e3b52cee35b9a01f89f73bffcd3775d66f51c95b88df1N.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[TempName].exe"C:\Users\Admin\AppData\Local\Temp\[TempName].exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-B1N1P.tmp\[TempName].tmp"C:\Users\Admin\AppData\Local\Temp\is-B1N1P.tmp\[TempName].tmp" /SL5="$D022A,2918001,69120,C:\Users\Admin\AppData\Local\Temp\[TempName].exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD51c7b4c1d054aa7ada5559d79df05a030
SHA1cae730040d5121128047d2ec8086423609a04beb
SHA256778c1b98f4ed5c0d101e3b52cee35b9a01f89f73bffcd3775d66f51c95b88df1
SHA5129f57ea74f06a7477ac58c0519b1616c497eb151af45863f0c1e29be20260dea9bbd306b16728724a0e4a0a2c8b717bdbf0a94755ba8e8f9c6440c327764aa474
-
Filesize
3.0MB
MD563736d5808289ec681461c5debb36cf9
SHA1d3e7c6b6de754786266f4b6e28eff442ff45937b
SHA2562a62fdd16aff304899eefad7c9135f1d5d482b3dfb7a8e248fa7b4b015eb89a2
SHA512fe28bd7a85f4adf90a3574aa774b43b86b74be3c4cfee8b7570abedcf925671042e3e3b8ba10e6108d454821286d35b4c7641426d29550e0fe90ba180d11f382
-
Filesize
703KB
MD51778c1f66ff205875a6435a33229ab3c
SHA15b6189159b16c6f85feed66834af3e06c0277a19
SHA25695c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA5128844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
312KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
3.2MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
768KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB