Analysis
-
max time kernel
151s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-05-2022 17:24
General
-
Target
0598d22513593a17f323e6f5fb78173c661a9a80147db5e716d3590981d8e60f.exe
-
Size
452KB
-
MD5
173de6d737993b9da11d02ac1ac898e4
-
SHA1
e63b521491492931546d0d9c41fd42e13e7a96d0
-
SHA256
0598d22513593a17f323e6f5fb78173c661a9a80147db5e716d3590981d8e60f
-
SHA512
353a7bf0cf727ec7f4a3f98863d60acd507e4f5570771aa1e64ab7d5011fbff85f00fff0534ef0936bc13504cb397b8a9957a52dd4a6f552ca3b62a2ae4ae2e2
Score
10/10
Malware Config
Signatures
-
Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0598d22513593a17f323e6f5fb78173c661a9a80147db5e716d3590981d8e60f.exe"C:\Users\Admin\AppData\Local\Temp\0598d22513593a17f323e6f5fb78173c661a9a80147db5e716d3590981d8e60f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\System32\System32.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
11.0MB
-
Filesize
7.7MB
-
Filesize
11.0MB
-
Filesize
5.7MB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB