Analysis
- max time kernel
168s - max time network
181s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
30/07/2022, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe
Resource
win7-20220718-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe
- Size 589KB
- Sample220730-yxncesedc2
- SHA256 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb
- MD5 a97cf3fdac54a472076f91bb64f43016
- SHA1 eed1f8eb3231e360210de741f891430f9f42c053
- SHA512 8865038ec32d22dece1e571bcd1d8a48a49f7207b1ba526517556ab38f6c0c24c23d075beee2b211a5175d61716a99ba01a9250f23ccd3889342f4047cafa17f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 1132 schtasks.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "\"C:\\Program Files (x86)\\Client\\explore.exe\" -a /a" 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1132 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 1132 schtasks.exe 1132 schtasks.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90 PID 2948 wrote to memory of 1132 2948 61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe"C:\Users\Admin\AppData\Local\Temp\61c43bf0b78395cd09bac1f355f162c24db2a3402a268ee7134c3aa7b8b8eacb.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\explore.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:1132
-