luminosity | 5b7a04a04253b565f4e05ed1f09534c3619f6f46e873b8348ca31cad804345ea

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
Size 1.8MB
Sample261016-e4tm8shs9j
SHA256 5b7a04a04253b565f4e05ed1f09534c3619f6f46e873b8348ca31cad804345ea
MD5 565171d47decd428ed019f06568344b7
SHA1 6f2bcd49be5b04ef2b513e04e7f891c1a391b705
SHA512 469765c72c2388713c85cd55f7a455e16d7376ac72f9e0d3a093540d29cd182d53aa973273cfb2fec7a58451326c0863d5744cac76088c249c5dddd664e72f50
SSDEEP 49152:pkwkn9IMHea9QBd3sLJSpvyuSxfWHfTaPCS:SdnVqDs0AffPC
TLSH
T13D95F10373DE83A5C3725133BA56BB01AEBF7C2506A5F09B2FD5093DE960162521EA73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
		3692	schtasks.exe

Executes dropped EXE 6 IoCs

pid	Process
4300	dcBdsSAc.exe
1168	DcA.exe
2220	DcA.exe
4480	client.exe
5344	client.exe
4152	client.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 4916	2220	DcA.exe	93

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	RegAsm.exe
File created	C:\Program Files (x86)\Client\client.exe.config	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DcA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcBdsSAc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DcA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2188	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
2188	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
4300	dcBdsSAc.exe
4300	dcBdsSAc.exe
1168	DcA.exe
1168	DcA.exe
1168	DcA.exe
1168	DcA.exe
2220	DcA.exe
2220	DcA.exe
2220	DcA.exe
2220	DcA.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe
4916	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4300	2188	jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe	89
PID 4300 wrote to memory of 1168	4300	dcBdsSAc.exe	90
PID 1168 wrote to memory of 2872	1168	DcA.exe	91
PID 1168 wrote to memory of 2220	1168	DcA.exe	92
PID 2220 wrote to memory of 4916	2220	DcA.exe	93
PID 2220 wrote to memory of 4916	2220	DcA.exe	93
PID 2220 wrote to memory of 4916	2220	DcA.exe	93
PID 2220 wrote to memory of 4916	2220	DcA.exe	93
PID 2220 wrote to memory of 4916	2220	DcA.exe	93
PID 4916 wrote to memory of 3692	4916	RegAsm.exe	94
PID 4916 wrote to memory of 1332	4916	RegAsm.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.cdh.exe"
1⤵
- Family: Luminosity
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\dcBdsSAc.exe
  "C:\Users\Admin\AppData\Local\Temp\dcBdsSAc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\DcA.exe
    "C:\Users\Admin\AppData\Local\Temp\DcA.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\DcA.exe
      C:\Users\Admin\AppData\Local\Temp\DcA.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        5⤵
        Drops file in Program Files directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4916
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
        6⤵
        Family: Luminosity
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3692
      - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1332

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5940

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.exe

Path C:\Program Files (x86)\Client\client.exe
Size 52KB
SHA256 f54e019c1896811e1d737c9f15b6b50b43ad6bff3a1dd952662f1b5bdc4069b9
MD5 c295725624e91cea14cb5e5d6faf15f0
SHA1 e563ad27d44f1d20341493f0ec8292827f64ae9c
SHA512 7fc76d9b8397665b044ca2716eedec5495ea90758dc041112d2596f7bd269c938b953a1f85c9c8b23f3fb41e7c2286e09bf4ea9e71bbadb95848f3c05635deb2
SSDEEP 768:8P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+250eFRJS8s+:fJv46yoD2BTNz1+M9GLfOYw8s+
TLSH
T1A133C814A7E84329F6FB4F795CF180068576B9979E26C35D298D039D0B363C4C922BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4916-26-0x0000000000400000-0x00000000004DC000-memory.dmp

Download