30a1ae69eb70083e1fe40c28becf7de5ec557705aae764af211f70f87ae5a403

Analysis

Target
da6e307361a7e93d778aa4dd9243e2a7.exe
Size 489KB
Sample210904-pvl7xaebe7
SHA256 30a1ae69eb70083e1fe40c28becf7de5ec557705aae764af211f70f87ae5a403
MD5 da6e307361a7e93d778aa4dd9243e2a7
SHA1 9a009135eaa181c581aa34a1bf53172eeb7aed30
SHA512 bc49ec8fd31bc5edc706a14cce38dbf5c45b6a0ce0c117070625e2c8ddec4c9372ad281e24a518f4be771a136ce193192a5a3a9ff6e935baa0dbcd9bc5d4f95c
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2016	lunar.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	lunar.exe
2016	lunar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2016	776	da6e307361a7e93d778aa4dd9243e2a7.exe	75
PID 776 wrote to memory of 2016	776	da6e307361a7e93d778aa4dd9243e2a7.exe	75
PID 776 wrote to memory of 2016	776	da6e307361a7e93d778aa4dd9243e2a7.exe	75

C:\Users\Admin\AppData\Local\Temp\da6e307361a7e93d778aa4dd9243e2a7.exe
"C:\Users\Admin\AppData\Local\Temp\da6e307361a7e93d778aa4dd9243e2a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\lunar.exe
  C:\Users\Admin\AppData\Local\Temp\lunar.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact