luminosity | 2c6f96fb8d061bf423a2716d9f55a95dafdaa770f8c9060c8173430077afa70c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
Size 807KB
Sample261016-e4h7hag18x
SHA256 2c6f96fb8d061bf423a2716d9f55a95dafdaa770f8c9060c8173430077afa70c
MD5 7e248673a993b63afebabb59e07cb291
SHA1 9ace1993ac08017c3c91e6a22f759bdcbd108d89
SHA512 61a5b97aa4c058053de7616177788aefba888928ee0a2cb18be41dcc5571ca10c2454dc998f12cf4a65b94f291ee0c30537bba36d59036cb087932022fc146c2
SSDEEP 12288:kLRBkuzX8W6RLIkNXcHEfVYKvQ6Joyd/v37Af1wc2CSO0a0g1:kLRBj65JNXcFKvQUFvaScFSOd0S
TLSH
T1FF0523D6EA012E59CA198C36C07B6D1627E1FD15766EAE6F0DC0B0B41BF30CAB742E15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
		4132	schtasks.exe

Executes dropped EXE 64 IoCs

pid	Process
1460	Temp3.exe
4872	Temp3.exe
796	Temp3.exe
4792	Temp3.exe
4476	Temp3.exe
4364	Temp3.exe
2404	Temp3.exe
5252	Temp3.exe
4768	Temp3.exe
2044	Temp3.exe
4276	Temp3.exe
2768	client.exe
2144	Temp3.exe
2776	Temp3.exe
2156	Temp3.exe
3924	Temp3.exe
1116	Temp3.exe
5076	Temp3.exe
936	Temp3.exe
1724	Temp3.exe
4928	Temp3.exe
5720	Temp3.exe
5220	client.exe
2644	Temp3.exe
2376	Temp3.exe
3500	Temp3.exe
4300	Temp3.exe
5464	Temp3.exe
4592	Temp3.exe
4920	Temp3.exe
3308	Temp3.exe
4848	Temp3.exe
2460	Temp3.exe
200	Temp3.exe
4852	Temp3.exe
2588	Temp3.exe
940	Temp3.exe
2952	Temp3.exe
1612	Temp3.exe
5768	Temp3.exe
1352	Temp3.exe
5172	Temp3.exe
5292	Temp3.exe
2496	Temp3.exe
2072	Temp3.exe
2852	Temp3.exe
1836	Temp3.exe
3456	Temp3.exe
348	Temp3.exe
3348	Temp3.exe
5896	Temp3.exe
6024	Temp3.exe
4516	Temp3.exe
4892	Temp3.exe
5012	Temp3.exe
1464	Temp3.exe
1600	Temp3.exe
5352	Temp3.exe
4372	Temp3.exe
5476	Temp3.exe
2348	Temp3.exe
4348	Temp3.exe
1900	Temp3.exe
5332	Temp3.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe
File created	C:\Program Files (x86)\Client\client.exe	Temp3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Temp3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Temp3.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp3.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4104	mspaint.exe
4104	mspaint.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
4104	mspaint.exe
4104	mspaint.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe
1460	Temp3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	Temp3.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4104	mspaint.exe
4104	mspaint.exe
4104	mspaint.exe
4104	mspaint.exe
1460	Temp3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4104	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	89
PID 1792 wrote to memory of 1460	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	90
PID 1792 wrote to memory of 4872	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	95
PID 1792 wrote to memory of 796	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	96
PID 1792 wrote to memory of 4792	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	97
PID 1792 wrote to memory of 4476	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	98
PID 1792 wrote to memory of 4364	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	99
PID 1792 wrote to memory of 2404	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	100
PID 1792 wrote to memory of 5252	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	101
PID 1792 wrote to memory of 4768	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	102
PID 1792 wrote to memory of 2044	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	103
PID 1460 wrote to memory of 4132	1460	Temp3.exe	104
PID 1792 wrote to memory of 4276	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	106
PID 1792 wrote to memory of 2144	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	109
PID 1792 wrote to memory of 2776	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	110
PID 1792 wrote to memory of 2156	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	111
PID 1460 wrote to memory of 4104	1460	Temp3.exe	89
PID 1460 wrote to memory of 4104	1460	Temp3.exe	89
PID 1460 wrote to memory of 4104	1460	Temp3.exe	89
PID 1460 wrote to memory of 4104	1460	Temp3.exe	89
PID 1792 wrote to memory of 3924	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	112
PID 1792 wrote to memory of 1116	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	113
PID 1792 wrote to memory of 5076	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	114
PID 1792 wrote to memory of 936	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	115
PID 1792 wrote to memory of 1724	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	116
PID 1792 wrote to memory of 4928	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	117
PID 1792 wrote to memory of 5720	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	118
PID 1792 wrote to memory of 2644	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	120
PID 1792 wrote to memory of 2376	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	121
PID 1460 wrote to memory of 1792	1460	Temp3.exe	88
PID 1460 wrote to memory of 1792	1460	Temp3.exe	88
PID 1460 wrote to memory of 1792	1460	Temp3.exe	88
PID 1460 wrote to memory of 1792	1460	Temp3.exe	88
PID 1792 wrote to memory of 3500	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	122
PID 1792 wrote to memory of 4300	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	123
PID 1792 wrote to memory of 5464	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	124
PID 1792 wrote to memory of 4592	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	125
PID 1792 wrote to memory of 4920	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	127
PID 1792 wrote to memory of 3308	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	128
PID 1792 wrote to memory of 4848	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	129
PID 1792 wrote to memory of 2460	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	130
PID 1792 wrote to memory of 200	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	131
PID 1792 wrote to memory of 4852	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	132
PID 1792 wrote to memory of 2588	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	133
PID 1792 wrote to memory of 940	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	134
PID 1792 wrote to memory of 2952	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	135
PID 1792 wrote to memory of 1612	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	136
PID 1792 wrote to memory of 5768	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	137
PID 1792 wrote to memory of 1352	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	138
PID 1792 wrote to memory of 5172	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	139
PID 1460 wrote to memory of 1568	1460	Temp3.exe	140
PID 1792 wrote to memory of 5292	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	142
PID 1792 wrote to memory of 2496	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	143
PID 1792 wrote to memory of 2072	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	144
PID 1792 wrote to memory of 2852	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	145
PID 1792 wrote to memory of 1836	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	146
PID 1792 wrote to memory of 3456	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	147
PID 1792 wrote to memory of 348	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	148
PID 1792 wrote to memory of 3348	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	149
PID 1792 wrote to memory of 5896	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	150
PID 1792 wrote to memory of 6024	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	151
PID 1792 wrote to memory of 4516	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	152
PID 1792 wrote to memory of 4892	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	153
PID 1792 wrote to memory of 5012	1792	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe	154

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bev.exe"
1⤵
- Family: Luminosity
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\ain.jpg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4104
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
    3⤵
    - Family: Luminosity
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    PID:1568
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:796
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4476
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5252
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2144
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:936
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5720
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5464
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3308
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:200
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3456
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:348
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1464
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5352
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4372
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5332
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4592
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1160
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2160
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5736
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:844
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5668
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4684
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4456
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5424
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2360
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5400
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3252
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1772
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3832
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2376
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3264
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5352
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1448
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5604
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5476
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4940
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2324
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5504
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3308
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5672
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5540
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1988
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3336
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5396
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4504
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3556
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1352
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:424
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3232
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3688
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:5888
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:4476
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:1116
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp3.exe
  "C:\Users\Admin\AppData\Local\Temp3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5960

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5220

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
PID:4504

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Temp3.exe

Path C:\Users\Admin\AppData\Local\Temp3.exe
Size 856KB
SHA256 261f754805de842e6157d72607a354f75d490975b49707d0dcb1729380ce17dc
MD5 6c9e065e155bed5b7913e01328f6ea3a
SHA1 59edca95caccfd2e42ae6118371eab325acabf3d
SHA512 5f0d3e057c83f40af1b4e9b49f3ca2777b7ccfded52ab1bb95a6424f274b8cd5c33c11b3dbb5e53678c349f2986ec6ce12b1e11e5d5693382873b4546b621d77
SSDEEP 24576:qdhGYxd4mmnMP2Jb7dGywJP5IgbDh/Wh4XfjQg:ghR/nm22pfuBI5h4L
TLSH
T1F115DF6A33589A51DF2DB73680BB6A1E10708B8BCB52C57A1C8438C79F153C6C716F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ain.jpg

Path C:\Users\Admin\AppData\Roaming\ain.jpg
Size 51KB
SHA256 1ff010e76240bf066df0338381fa07e3e660370ec7825342cdf8b454a4dffd67
MD5 201578b8531305fc7c9f29ee5b156cae
SHA1 f1a21ba4f47384b65f9a1a67bc2aab04c3408381
SHA512 4367919317658babd28f7312bf2abb993109c1fa8a8f791ea85ec76ff6d8816cad6f2c94efd3eb234515b78a0bc2b1090a5b7888360c1b02bae2c22b3ce4aec7
SSDEEP 768:/wkwE2GUTqNkzuAlj6gWBUxWiUFIgn837mq7Aqzeu2m8bwEbRUJK1EbSMG7MUGDO:/83TqN+6vBUxWingnmmMfKHB8CEqKD7S
TLSH
T18633F1F9CA3B36DE422BD7206359710AFF17B50B9859238A24F4260D775E94D0347BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-43-0x0000000001D10000-0x0000000001D20000-memory.dmp

Download

memory/1460-24-0x0000000001D10000-0x0000000001D20000-memory.dmp

Download

memory/1792-34-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/1792-66-0x00000000070A0000-0x00000000070B7000-memory.dmp

Download

memory/1792-6-0x0000000005550000-0x00000000055A6000-memory.dmp

Download

memory/1792-7-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/1792-8-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/1792-9-0x0000000008C80000-0x0000000008D68000-memory.dmp

Download

memory/1792-3-0x0000000005410000-0x00000000054A2000-memory.dmp

Download

memory/1792-4-0x00000000054B0000-0x000000000554C000-memory.dmp

Download

memory/1792-2-0x00000000059D0000-0x0000000005F8A000-memory.dmp

Download

memory/1792-31-0x0000000074812000-0x0000000074813000-memory.dmp

Download

memory/1792-0-0x0000000074812000-0x0000000074813000-memory.dmp

Download

memory/1792-39-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/1792-1-0x0000000000790000-0x000000000085E000-memory.dmp

Download

memory/1792-68-0x00000000070A0000-0x00000000070B7000-memory.dmp

Download

memory/1792-64-0x00000000070A0000-0x00000000070B7000-memory.dmp

Download

memory/1792-65-0x00000000070A0000-0x00000000070B7000-memory.dmp

Download

memory/1792-5-0x0000000005360000-0x000000000536A000-memory.dmp

Download

memory/1792-67-0x00000000070C0000-0x00000000070C1000-memory.dmp

Download

memory/4104-50-0x0000000003AA0000-0x0000000003AB7000-memory.dmp

Download

memory/4104-52-0x0000000003AA0000-0x0000000003AB7000-memory.dmp

Download

memory/4104-49-0x0000000003AA0000-0x0000000003AB7000-memory.dmp

Download

memory/4104-51-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

Download

memory/4104-48-0x0000000003AA0000-0x0000000003AB7000-memory.dmp

Download

memory/4504-109-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download

memory/4504-108-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download

memory/4504-107-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download