Analysis
-
max time kernel
160s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-01-2022 00:23
General
-
Target
d8692eee5da95946cd60b044149febc180fd04f33427c22e596f1a3496fb46fd.exe
-
Size
825KB
-
MD5
aafdee89db0e8f4c4010582e8fcc2569
-
SHA1
bd5ffc93217fc49b1ef922cd2818a6d3bee4b66c
-
SHA256
d8692eee5da95946cd60b044149febc180fd04f33427c22e596f1a3496fb46fd
-
SHA512
7c97644288e5d65d9d65c72943d0a4405acf558742fb494dbff173e452340087044b632ca986f260a416ab31579eb2fcf5b08ef437a66a9d72d1b8ccfcabc12e
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8692eee5da95946cd60b044149febc180fd04f33427c22e596f1a3496fb46fd.exe"C:\Users\Admin\AppData\Local\Temp\d8692eee5da95946cd60b044149febc180fd04f33427c22e596f1a3496fb46fd.exe"1⤵
- Luminosity
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "AdobePDF" /rl highest /tr "'C:\Program Files (x86)\PDF\PDF.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB