30a1ae69eb70083e1fe40c28becf7de5ec557705aae764af211f70f87ae5a403

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-en
submitted
04/09/2021, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da6e307361a7e93d778aa4dd9243e2a7.exe
Size 489KB
Sample210904-pvl7xaebe7
SHA256 30a1ae69eb70083e1fe40c28becf7de5ec557705aae764af211f70f87ae5a403
MD5 da6e307361a7e93d778aa4dd9243e2a7
SHA1 9a009135eaa181c581aa34a1bf53172eeb7aed30
SHA512 bc49ec8fd31bc5edc706a14cce38dbf5c45b6a0ce0c117070625e2c8ddec4c9372ad281e24a518f4be771a136ce193192a5a3a9ff6e935baa0dbcd9bc5d4f95c
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
652	lunar.exe

Loads dropped DLL 2 IoCs

pid	Process
652	lunar.exe
652	lunar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
652	lunar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 652	1076	da6e307361a7e93d778aa4dd9243e2a7.exe	31
PID 1076 wrote to memory of 652	1076	da6e307361a7e93d778aa4dd9243e2a7.exe	31
PID 1076 wrote to memory of 652	1076	da6e307361a7e93d778aa4dd9243e2a7.exe	31
PID 1076 wrote to memory of 652	1076	da6e307361a7e93d778aa4dd9243e2a7.exe	31

C:\Users\Admin\AppData\Local\Temp\da6e307361a7e93d778aa4dd9243e2a7.exe
"C:\Users\Admin\AppData\Local\Temp\da6e307361a7e93d778aa4dd9243e2a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\lunar.exe
  C:\Users\Admin\AppData\Local\Temp\lunar.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Download

memory/1076-52-0x000007FEFB951000-0x000007FEFB953000-memory.dmp