Analysis
-
max time kernel
201s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 21:40
Static task
static1
Behavioral task
behavioral1
Sample
24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe
-
Size
452KB
-
MD5
37fd7205a677a53c500961a6dcf81ae2
-
SHA1
0116fb86ddf39fd75c8ba09533d47d6a78f6279f
-
SHA256
24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa
-
SHA512
78796cfd0265829d8d41e7d120281f844c03e71232d95cc396ef93932653080ad8dc90e1f0dc41f9d12363907ff60057fcc8366b2de57713ef982c02ea518bfb
Score
10/10
Malware Config
Signatures
-
Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 4776 schtasks.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "\"C:\\Program Files (x86)\\Client\\client.exe\" -a /a" 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4776 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 78 PID 4792 wrote to memory of 4776 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 78 PID 4792 wrote to memory of 4776 4792 24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe"C:\Users\Admin\AppData\Local\Temp\24a39b394547fb68df258e09d7f9af7e1669e9836260274a9c08b45506dba2fa.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
PID:4776
-