Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 13:28
Static task
static1
Behavioral task
behavioral1
Sample
29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
-
Size
452KB
-
MD5
4b3c531bc19955b5ac4c781b9c893752
-
SHA1
954ed8f2b5eee6de1bc614aac9e691da12cbab34
-
SHA256
29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7
-
SHA512
3cf5ba7f292fb0b5c02e18514e672f8578de25fa56074ca6191c7a4718eff6b31da43b0ed75d77df7a47fd0d09cf6829c798f808d5e203c87baea033ba813dbb
Score
10/10
Malware Config
Signatures
-
Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 2084 schtasks.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "\"C:\\Program Files (x86)\\System32\\System32.exe\" -a /a" 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2084 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 89 PID 2216 wrote to memory of 2084 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 89 PID 2216 wrote to memory of 2084 2216 29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe"C:\Users\Admin\AppData\Local\Temp\29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\System32\System32.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
PID:2084
-