Analysis
- max time kernel
164s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2022, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
Resource
win7-20220715-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
- Size 658KB
- Sample220802-crmcaagbem
- SHA256 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991
- MD5 8ab0bc1a07b752cf0ceb06f27cc75c0c
- SHA1 df3e3763855f58c40eee189907dc5486ae1b7fbf
- SHA512 d9880bd6686645ff0d42825eb13105198526de7a95304a7423d0a3aab3512f8e5cb215ef4e8e561df576e32aa85fa83c73fe1f2c6f5ad3c4e1e86efb85485c9c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 4912 schtasks.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4912 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89 PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89 PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe"C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "WindowsUpdateTask" /rl highest /tr "'C:\Program Files (x86)\SystemCertificates\taskmrg.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
PID:4912
-