luminosity | 2c6f96fb8d061bf423a2716d9f55a95dafdaa770f8c9060c8173430077afa70c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
Size 807KB
Sample261016-e4h7hag18x
SHA256 2c6f96fb8d061bf423a2716d9f55a95dafdaa770f8c9060c8173430077afa70c
MD5 7e248673a993b63afebabb59e07cb291
SHA1 9ace1993ac08017c3c91e6a22f759bdcbd108d89
SHA512 61a5b97aa4c058053de7616177788aefba888928ee0a2cb18be41dcc5571ca10c2454dc998f12cf4a65b94f291ee0c30537bba36d59036cb087932022fc146c2
SSDEEP 12288:kLRBkuzX8W6RLIkNXcHEfVYKvQ6Joyd/v37Af1wc2CSO0a0g1:kLRBj65JNXcFKvQUFvaScFSOd0S
TLSH
T1FF0523D6EA012E59CA198C36C07B6D1627E1FD15766EAE6F0DC0B0B41BF30CAB742E15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
		2700	schtasks.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe

Executes dropped EXE 64 IoCs

pid	Process
4304	Temp3.exe
4672	Temp3.exe
1548	Temp3.exe
4828	Temp3.exe
3760	Temp3.exe
1836	Temp3.exe
3800	Temp3.exe
1704	Temp3.exe
3088	Temp3.exe
4792	Temp3.exe
4884	Temp3.exe
1964	client.exe
312	Temp3.exe
3408	Temp3.exe
1904	Temp3.exe
2664	Temp3.exe
752	Temp3.exe
1840	Temp3.exe
1496	Temp3.exe
740	Temp3.exe
2340	Temp3.exe
3128	Temp3.exe
2052	client.exe
1680	Temp3.exe
2444	Temp3.exe
1772	Temp3.exe
1304	Temp3.exe
1836	Temp3.exe
1736	Temp3.exe
4232	Temp3.exe
3924	Temp3.exe
1704	Temp3.exe
4900	Temp3.exe
4144	Temp3.exe
360	Temp3.exe
3820	Temp3.exe
4444	Temp3.exe
2556	Temp3.exe
1728	Temp3.exe
2376	Temp3.exe
3460	Temp3.exe
1768	Temp3.exe
616	client.exe
1228	Temp3.exe
5028	Temp3.exe
3204	Temp3.exe
5048	Temp3.exe
428	Temp3.exe
3544	Temp3.exe
3604	Temp3.exe
4804	Temp3.exe
4320	Temp3.exe
1360	Temp3.exe
2640	Temp3.exe
3732	Temp3.exe
1496	Temp3.exe
2832	Temp3.exe
1316	Temp3.exe
816	Temp3.exe
4480	Temp3.exe
1512	Temp3.exe
3444	Temp3.exe
1964	Temp3.exe
4988	Temp3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Temp3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Temp3.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe
4304	Temp3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	Temp3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	Temp3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4304	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	88
PID 1808 wrote to memory of 4672	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	91
PID 1808 wrote to memory of 1548	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	92
PID 1808 wrote to memory of 4828	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	95
PID 1808 wrote to memory of 3760	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	96
PID 1808 wrote to memory of 1836	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	97
PID 1808 wrote to memory of 3800	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	99
PID 1808 wrote to memory of 1704	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	100
PID 1808 wrote to memory of 3088	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	101
PID 1808 wrote to memory of 4792	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	104
PID 4304 wrote to memory of 2700	4304	Temp3.exe	105
PID 1808 wrote to memory of 4884	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	107
PID 1808 wrote to memory of 312	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	110
PID 1808 wrote to memory of 3408	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	111
PID 1808 wrote to memory of 1904	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	112
PID 1808 wrote to memory of 2664	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	113
PID 1808 wrote to memory of 752	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	114
PID 1808 wrote to memory of 1840	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	115
PID 1808 wrote to memory of 1496	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	116
PID 1808 wrote to memory of 740	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	117
PID 1808 wrote to memory of 2340	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	118
PID 1808 wrote to memory of 3128	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	119
PID 1808 wrote to memory of 1680	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	121
PID 4304 wrote to memory of 1808	4304	Temp3.exe	84
PID 4304 wrote to memory of 1808	4304	Temp3.exe	84
PID 4304 wrote to memory of 1808	4304	Temp3.exe	84
PID 4304 wrote to memory of 1808	4304	Temp3.exe	84
PID 1808 wrote to memory of 2444	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	122
PID 1808 wrote to memory of 1772	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	123
PID 1808 wrote to memory of 1304	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	124
PID 1808 wrote to memory of 1836	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	125
PID 1808 wrote to memory of 1736	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	126
PID 1808 wrote to memory of 4232	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	127
PID 1808 wrote to memory of 3924	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	129
PID 1808 wrote to memory of 1704	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	131
PID 1808 wrote to memory of 4900	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	132
PID 1808 wrote to memory of 4144	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	133
PID 1808 wrote to memory of 360	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	134
PID 1808 wrote to memory of 3820	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	135
PID 1808 wrote to memory of 4444	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	136
PID 1808 wrote to memory of 2556	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	139
PID 1808 wrote to memory of 1728	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	141
PID 1808 wrote to memory of 2376	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	144
PID 1808 wrote to memory of 3460	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	146
PID 1808 wrote to memory of 1768	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	147
PID 4304 wrote to memory of 3800	4304	Temp3.exe	148
PID 5040 wrote to memory of 616	5040	cmd.exe	152
PID 1808 wrote to memory of 1228	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	153
PID 1808 wrote to memory of 5028	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	154
PID 1808 wrote to memory of 3204	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	155
PID 1808 wrote to memory of 5048	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	156
PID 1808 wrote to memory of 428	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	157
PID 1808 wrote to memory of 3544	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	158
PID 1808 wrote to memory of 3604	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	159
PID 1808 wrote to memory of 4804	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	160
PID 1808 wrote to memory of 4320	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	161
PID 1808 wrote to memory of 1360	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	162
PID 1808 wrote to memory of 2640	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	163
PID 1808 wrote to memory of 3732	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	164
PID 1808 wrote to memory of 1496	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	165
PID 1808 wrote to memory of 2832	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	166
PID 1808 wrote to memory of 1316	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	167
PID 1808 wrote to memory of 816	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	168
PID 1808 wrote to memory of 4480	1808	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	169

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe"
1⤵
- Family: Luminosity
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Family: Luminosity
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3800
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1548
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4828
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3760
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:312
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3408
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1904
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1772
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1836
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1704
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:360
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3460
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1228
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3604
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4320
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1496
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4480
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3924
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3276
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3420
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5052
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4140
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2112
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:628
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4552
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1344
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1548
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4972
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3440
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4416
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2180
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:740
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3224
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:624
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:984
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3516
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:688
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3556
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1564
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2552
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4092
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4792
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3924
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:808
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4416
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4412
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3036
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3664
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4996
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052

C:\Windows\system32\cmd.exe
"cmd /c "start "Client Monitor" "C:\Program Files (x86)\Client\client.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Client\client.exe
  "C:\Program Files (x86)\Client\client.exe"
  2⤵
  - Executes dropped EXE
  PID:616

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
PID:1708

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Temp3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Temp3.exe.log
Size 408B
SHA256 b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
MD5 42157868488d3ef98c00e3fa12f064be
SHA1 aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA512 8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
TLSH
T130E06830363298E80C202A100801BFDA56FF435B7BA8DF2C5659535DEE2A497EB112F3
MD5 SHA1 SHA512 TLSH

Submit Download

client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\client.exe.log
Size 588B
SHA256 9269d4383b8effa928b7b4a7b38ffa07587b23851f9430fbfe8e7284f845e722
MD5 bbc3cfe1a58732a0477f72ea3d36c7bf
SHA1 fb801263330aa243f63270138ab467a627dffc2e
SHA512 5bfdc6520a7a0884e3ccdf26ab0fe536327c9f3330f7f78bed2ed4c89fc31b04ad0c4b4bd6f8f1bca08ef04e46b833b798726dca7f40ccc27c871847ec041be4
TLSH
T127F02B30362298D80D202B110800BFDA66FF475A7BA8DF1C666A535DEE2A497EB115F3
MD5 SHA1 SHA512 TLSH

Submit Download

Temp3.exe

Path C:\Users\Admin\AppData\Local\Temp3.exe
Size 856KB
SHA256 261f754805de842e6157d72607a354f75d490975b49707d0dcb1729380ce17dc
MD5 6c9e065e155bed5b7913e01328f6ea3a
SHA1 59edca95caccfd2e42ae6118371eab325acabf3d
SHA512 5f0d3e057c83f40af1b4e9b49f3ca2777b7ccfded52ab1bb95a6424f274b8cd5c33c11b3dbb5e53678c349f2986ec6ce12b1e11e5d5693382873b4546b621d77
SSDEEP 24576:qdhGYxd4mmnMP2Jb7dGywJP5IgbDh/Wh4XfjQg:ghR/nm22pfuBI5h4L
TLSH
T1F115DF6A33589A51DF2DB73680BB6A1E10708B8BCB52C57A1C8438C79F153C6C716F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-38-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1808-0-0x0000000000FF0000-0x00000000010BE000-memory.dmp

Download

memory/1808-5-0x0000000005A60000-0x0000000005A6A000-memory.dmp

Download

memory/1808-6-0x0000000005D70000-0x0000000005DC6000-memory.dmp

Download

memory/1808-7-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1808-8-0x0000000008A80000-0x0000000008B68000-memory.dmp

Download

memory/1808-3-0x0000000005B20000-0x0000000005BBC000-memory.dmp

Download

memory/1808-69-0x0000000005F90000-0x0000000005FA7000-memory.dmp

Download

memory/1808-1-0x0000000006030000-0x00000000065D4000-memory.dmp

Download

memory/1808-4-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1808-73-0x0000000005F90000-0x0000000005FA7000-memory.dmp

Download

memory/1808-32-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1808-72-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Download

memory/1808-71-0x0000000005F90000-0x0000000005FA7000-memory.dmp

Download

memory/1808-2-0x0000000005A80000-0x0000000005B12000-memory.dmp

Download

memory/1808-70-0x0000000005F90000-0x0000000005FA7000-memory.dmp

Download

memory/4304-47-0x000000006EE12000-0x000000006EE14000-memory.dmp

Download

memory/4304-42-0x00000000006E0000-0x00000000006F0000-memory.dmp

Download

memory/4304-19-0x000000006EE12000-0x000000006EE14000-memory.dmp

Download

memory/4304-18-0x00000000006E0000-0x00000000006F0000-memory.dmp

Download

memory/4672-22-0x000000006EE10000-0x000000006F3C1000-memory.dmp

Download

memory/4672-60-0x000000006EE10000-0x000000006F3C1000-memory.dmp

Download

memory/4672-52-0x000000006EE10000-0x000000006F3C1000-memory.dmp

Download

memory/4672-24-0x000000006EE10000-0x000000006F3C1000-memory.dmp

Download