Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe
-
Size
375KB
-
MD5
1cc1d98d0f436ae1ad3cbaee01c049dd
-
SHA1
d35805cb394cfc4dc80b49d826e981e3121071b4
-
SHA256
e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3
-
SHA512
97914527bbf8e0c63bf885e4c5b7ab427f3752b67f996b45eef8b5379afe89ad296b6224c17c018dc29d2670abe364d29b388c196bd378be3210840156574de2
Score
10/10
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
description ioc pid Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\SystemCertificates\CA e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4060 schtasks.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3908 set thread context of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe Token: SeDebugPrivilege 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 3908 wrote to memory of 4144 3908 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 81 PID 4144 wrote to memory of 4060 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 88 PID 4144 wrote to memory of 4060 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 88 PID 4144 wrote to memory of 4060 4144 e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe"C:\Users\Admin\AppData\Local\Temp\e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe"1⤵
- Luminosity
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe"C:\Users\Admin\AppData\Local\Temp\e02e885c2ce087d48262d46b0db433b576d522186b609ac158ad89c973c6fcf3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "System Monitor" /rl highest /tr "'C:\ProgramData\476836\sysmon.exe' /startup" /f3⤵
- Luminosity
- Creates scheduled task(s)
PID:4060
-
-