luminosity | 5b7a04a04253b565f4e05ed1f09534c3619f6f46e873b8348ca31cad804345ea

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
Size 1.8MB
Sample261016-e4tm8shs9j
SHA256 5b7a04a04253b565f4e05ed1f09534c3619f6f46e873b8348ca31cad804345ea
MD5 565171d47decd428ed019f06568344b7
SHA1 6f2bcd49be5b04ef2b513e04e7f891c1a391b705
SHA512 469765c72c2388713c85cd55f7a455e16d7376ac72f9e0d3a093540d29cd182d53aa973273cfb2fec7a58451326c0863d5744cac76088c249c5dddd664e72f50
SSDEEP 49152:pkwkn9IMHea9QBd3sLJSpvyuSxfWHfTaPCS:SdnVqDs0AffPC
TLSH
T13D95F10373DE83A5C3725133BA56BB01AEBF7C2506A5F09B2FD5093DE960162521EA73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
		5108	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	EFfcFZ.exe

Executes dropped EXE 7 IoCs

pid	Process
5212	EFfcFZ.exe
4888	oIAdXmhs.exe
5408	oIAdXmhs.exe
1244	client.exe
5992	client.exe
2296	client.exe
4076	client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5408 set thread context of 2572	5408	oIAdXmhs.exe	104

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	RegAsm.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	RegAsm.exe
File created	C:\Program Files (x86)\Client\client.exe.config	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EFfcFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oIAdXmhs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oIAdXmhs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4032	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
4032	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
5212	EFfcFZ.exe
5212	EFfcFZ.exe
4888	oIAdXmhs.exe
4888	oIAdXmhs.exe
4888	oIAdXmhs.exe
4888	oIAdXmhs.exe
5408	oIAdXmhs.exe
5408	oIAdXmhs.exe
5408	oIAdXmhs.exe
5408	oIAdXmhs.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe
2572	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5212	4032	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe	95
PID 5212 wrote to memory of 4888	5212	EFfcFZ.exe	101
PID 4888 wrote to memory of 5968	4888	oIAdXmhs.exe	102
PID 4888 wrote to memory of 5408	4888	oIAdXmhs.exe	103
PID 5408 wrote to memory of 2572	5408	oIAdXmhs.exe	104
PID 5408 wrote to memory of 2572	5408	oIAdXmhs.exe	104
PID 5408 wrote to memory of 2572	5408	oIAdXmhs.exe	104
PID 5408 wrote to memory of 2572	5408	oIAdXmhs.exe	104
PID 5408 wrote to memory of 2572	5408	oIAdXmhs.exe	104
PID 2572 wrote to memory of 5108	2572	RegAsm.exe	107
PID 2572 wrote to memory of 5220	2572	RegAsm.exe	122
PID 4276 wrote to memory of 2296	4276	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe"
1⤵
- Family: Luminosity
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\EFfcFZ.exe
  "C:\Users\Admin\AppData\Local\Temp\EFfcFZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Users\Admin\AppData\Local\Temp\oIAdXmhs.exe
    "C:\Users\Admin\AppData\Local\Temp\oIAdXmhs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\oIAdXmhs.exe
      C:\Users\Admin\AppData\Local\Temp\oIAdXmhs.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        5⤵
        Drops file in Program Files directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2572
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
        6⤵
        Family: Luminosity
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5108
      - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5220

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5992

C:\Windows\system32\cmd.exe
"cmd /c "start "Client Monitor" "C:\Program Files (x86)\Client\client.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Client\client.exe
  "C:\Program Files (x86)\Client\client.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2296

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.exe

Path C:\Program Files (x86)\Client\client.exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
TLSH
T12C33C818A7E8432AF6FB4F755CF180068576B9979E26C31D298D039D0B363C4C922BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.exe.config

Path C:\Program Files (x86)\Client\client.exe.config
Size 181B
SHA256 325b14941e79aeb570eb4062714d446f70b51db3c14fa58c5d2f90c8dafe3c3e
MD5 0366f988e5ea426d80338070d8fa241b
SHA1 153b90af59d0598a0d5f5e083cb7ff24e2f7adcf
SHA512 563a39c5958ae6f507e37923959a8a2608c7e9a6f338053edc142d8038849043c6050df2946116876102704ff14d6b36314aca468d91a7f3279754df2aba0bc2
TLSH
T156C01245869DBD266C334A2713050941BFB552C24226100CB15E16631B2249E439F311
MD5 SHA1 SHA512 TLSH

Submit Download

client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\client.exe.log
Size 20B
SHA256 7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432
MD5 b3ac9d09e3a47d5fd00c37e075a70ecb
SHA1 ad14e6d0e07b00bd10d77a06d68841b20675680b
SHA512 09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316
MD5 SHA1 SHA512

Submit Download

SDqr.x5

Path C:\Users\Admin\AppData\Local\Temp\SDqr.x5
Size 856KB
SHA256 c5e26194174334f01eb6a2d7f0ee1e4d0678a0bb82905167b83c7b56c5913d09
MD5 96f38cd81cd61e21f2fe8a0453130c19
SHA1 d7c9f9c19478907bb329a84014e199ed011a668b
SHA512 be58adb04d771db81082e1a7fe969834e302c4c1112375b81255a92a9d5c2a3a641982ad17774091d083202c362e6b5aacf7795201612ddeda4fe45256cc495d
SSDEEP 24576:28DxVgaqY7UAoFzX/Kw71i0m01nfNXS0vaVKs0uNQ:28FVg27Y/KB0pVfRS90uK
TLSH
T1FB15337A31F716D359B806B53EA9C5682507A26860EF8EDE626345CFCD00B43F163F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2572-35-0x0000000000400000-0x00000000004DC000-memory.dmp

Download