Analysis
-
max time kernel
164s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
Resource
win7-20220715-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
-
Size
658KB
-
MD5
8ab0bc1a07b752cf0ceb06f27cc75c0c
-
SHA1
df3e3763855f58c40eee189907dc5486ae1b7fbf
-
SHA256
5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991
-
SHA512
d9880bd6686645ff0d42825eb13105198526de7a95304a7423d0a3aab3512f8e5cb215ef4e8e561df576e32aa85fa83c73fe1f2c6f5ad3c4e1e86efb85485c9c
Score
10/10
Malware Config
Signatures
-
Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
pid Process 4912 schtasks.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4912 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89 PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89 PID 1592 wrote to memory of 4912 1592 5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe"C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc onlogon /tn "WindowsUpdateTask" /rl highest /tr "'C:\Program Files (x86)\SystemCertificates\taskmrg.exe' /startup" /f2⤵
- Luminosity
- Creates scheduled task(s)
PID:4912
-