Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 21:37
Static task
static1
Behavioral task
behavioral1
Sample
f9d78ddd7ef2f4200e83aa452d03192c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f9d78ddd7ef2f4200e83aa452d03192c.exe
Resource
win10v2004-20231215-en
General
-
Target
f9d78ddd7ef2f4200e83aa452d03192c.exe
-
Size
411KB
-
MD5
f9d78ddd7ef2f4200e83aa452d03192c
-
SHA1
979824983e7ff0faf2c3f98c5ddad74c40d0ea7e
-
SHA256
c98e242323138170045011f3ab41dc6a811e7ed7fd27a98e6d12bef5da72181a
-
SHA512
286737f8b8b731e66e8ac9cc3aee7e38ad8a6bd3666be23204a3a0908de1c27faa7d73974546eec061e7f3bcd6ae0c75743a342630c79e30c2c94be37f182ea0
-
SSDEEP
12288:CJKuu0b2YF4NCI+48ykABbPCpmj+uJoSznCn:TqSz4I+48yVBbPCpmSgI
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exeadobeupdater.exeadobeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f9d78ddd7ef2f4200e83aa452d03192c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f9d78ddd7ef2f4200e83aa452d03192c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion adobeupdater.exe -
Executes dropped EXE 5 IoCs
Processes:
adobeupdater.exeadobeupdater.exeadobeupdater.exeadobeupdater.exeadobeupdater.exepid process 2276 adobeupdater.exe 2352 adobeupdater.exe 2064 adobeupdater.exe 880 adobeupdater.exe 3616 adobeupdater.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exeadobeupdater.exeadobeupdater.exedescription pid process target process PID 1040 set thread context of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 2276 set thread context of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2064 set thread context of 880 2064 adobeupdater.exe adobeupdater.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 9 IoCs
Processes:
adobeupdater.exeadobeupdater.exef9d78ddd7ef2f4200e83aa452d03192c.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName adobeupdater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS adobeupdater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer adobeupdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName adobeupdater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS f9d78ddd7ef2f4200e83aa452d03192c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer f9d78ddd7ef2f4200e83aa452d03192c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName f9d78ddd7ef2f4200e83aa452d03192c.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exeadobeupdater.exeadobeupdater.exepid process 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2276 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe 2064 adobeupdater.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exeadobeupdater.exeadobeupdater.exedescription pid process Token: SeDebugPrivilege 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe Token: SeDebugPrivilege 2276 adobeupdater.exe Token: SeDebugPrivilege 2064 adobeupdater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exepid process 116 f9d78ddd7ef2f4200e83aa452d03192c.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
f9d78ddd7ef2f4200e83aa452d03192c.exeadobeupdater.exeadobeupdater.exedescription pid process target process PID 1040 wrote to memory of 3888 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe schtasks.exe PID 1040 wrote to memory of 3888 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe schtasks.exe PID 1040 wrote to memory of 3888 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe schtasks.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 1040 wrote to memory of 116 1040 f9d78ddd7ef2f4200e83aa452d03192c.exe f9d78ddd7ef2f4200e83aa452d03192c.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2276 wrote to memory of 2352 2276 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe PID 2064 wrote to memory of 880 2064 adobeupdater.exe adobeupdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d78ddd7ef2f4200e83aa452d03192c.exe"C:\Users\Admin\AppData\Local\Temp\f9d78ddd7ef2f4200e83aa452d03192c.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9d78ddd7ef2f4200e83aa452d03192c.exe"C:\Users\Admin\AppData\Local\Temp\f9d78ddd7ef2f4200e83aa452d03192c.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn test /tr "'C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe'"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exeC:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exeC:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exeC:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\adobeupdater.exe.logFilesize
588B
MD598f09da01067723bbca687b457aed4b4
SHA10d36e783d3d5ce230acf900258c7e3e4495a313e
SHA256c48329330058a0624781f0b0eb38756e7e66257df2e8d78f73ece0e949421ec9
SHA512b4e553805159904221c3eeb90dab7dbc3a38a1683cb9de0f9ab5a581cbb237461b05e81fd61ed081bc8ac34f4cd91b7b3179a4a3fac87f3da7c9b447130673bd
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeupdater.exeFilesize
411KB
MD5f9d78ddd7ef2f4200e83aa452d03192c
SHA1979824983e7ff0faf2c3f98c5ddad74c40d0ea7e
SHA256c98e242323138170045011f3ab41dc6a811e7ed7fd27a98e6d12bef5da72181a
SHA512286737f8b8b731e66e8ac9cc3aee7e38ad8a6bd3666be23204a3a0908de1c27faa7d73974546eec061e7f3bcd6ae0c75743a342630c79e30c2c94be37f182ea0
-
memory/116-64-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/116-70-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/116-67-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/116-71-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/880-210-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/880-209-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/880-207-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1040-16-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-8-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-58-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-61-0x0000000001800000-0x0000000001810000-memory.dmpFilesize
64KB
-
memory/1040-68-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1040-62-0x0000000001800000-0x0000000001810000-memory.dmpFilesize
64KB
-
memory/1040-60-0x0000000001800000-0x0000000001810000-memory.dmpFilesize
64KB
-
memory/1040-59-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/1040-56-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-54-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-52-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-50-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-48-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-44-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-42-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-40-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-38-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-36-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-34-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-32-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-30-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-28-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-26-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-24-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-22-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-20-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-18-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-4-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-14-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-12-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-10-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-46-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-6-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1040-0-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1040-1-0x0000000001800000-0x0000000001810000-memory.dmpFilesize
64KB
-
memory/1040-2-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1040-3-0x00000000065F0000-0x0000000006609000-memory.dmpFilesize
100KB
-
memory/1808-276-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1808-278-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1808-280-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/1808-277-0x0000000000A90000-0x0000000000AA0000-memory.dmpFilesize
64KB
-
memory/2064-204-0x0000000001190000-0x00000000011A0000-memory.dmpFilesize
64KB
-
memory/2064-208-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2064-144-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2064-146-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2064-145-0x0000000001190000-0x00000000011A0000-memory.dmpFilesize
64KB
-
memory/2064-203-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/2276-133-0x0000000000EC0000-0x0000000000ED0000-memory.dmpFilesize
64KB
-
memory/2276-138-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2276-74-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2276-131-0x0000000005E00000-0x0000000005E01000-memory.dmpFilesize
4KB
-
memory/2276-132-0x0000000000EC0000-0x0000000000ED0000-memory.dmpFilesize
64KB
-
memory/2352-140-0x00000000015B0000-0x00000000015C0000-memory.dmpFilesize
64KB
-
memory/2352-141-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2352-139-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/2352-142-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/3616-212-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/3616-273-0x0000000001550000-0x0000000001560000-memory.dmpFilesize
64KB
-
memory/3616-272-0x0000000001550000-0x0000000001560000-memory.dmpFilesize
64KB
-
memory/3616-279-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/3616-271-0x00000000066A0000-0x00000000066A1000-memory.dmpFilesize
4KB
-
memory/3616-214-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/3616-213-0x0000000001550000-0x0000000001560000-memory.dmpFilesize
64KB