Analysis
-
max time kernel
153s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 11:23
Static task
static1
Behavioral task
behavioral1
Sample
20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe
-
Size
852KB
-
MD5
7bc5c48e8e95526e4adb155a561bc09b
-
SHA1
755b965d1c32ff5af956cb68a6463f0f71a5895a
-
SHA256
20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71
-
SHA512
c9db71c27a13a580c27d830d3098d7d2389b1d74d01fde3f429ff1881dc0132884cd58d0ef1002b1dfa51bd320d24b71629b3785262c9125d64a5565c84ba571
Score
10/10
Malware Config
Signatures
-
Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 540 schtasks.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3136 set thread context of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 540 schtasks.exe 540 schtasks.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe Token: SeDebugPrivilege 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 3136 wrote to memory of 4488 3136 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 79 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80 PID 4488 wrote to memory of 540 4488 20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe"C:\Users\Admin\AppData\Local\Temp\20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe"C:\Users\Admin\AppData\Local\Temp\20caa9abe0b37c0d09b041b84573c3a62deceb9a3e5e876e4725ece403b72c71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "System Monitor" /rl highest /tr "'C:\ProgramData\722824\sysmon.exe' /startup" /f3⤵
- Luminosity
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-