Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-02-2023 18:56
Behavioral task
behavioral1
Sample
luna_new.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
luna_new.exe
Resource
win10v2004-20221111-en
General
-
Target
luna_new.exe
-
Size
16.3MB
-
MD5
771f78eec820f0d6c6a160ad99cbe9c7
-
SHA1
3808c4f9e5f6515d941cf5bb1e310cab44382d6c
-
SHA256
8e4ce102a531d540a1f643396d6ddfc0da9acc963ca995bcba9d07909ebb58e0
-
SHA512
83438bd2fb28401ed480f8934c0ec9f9bb04d0e5f8c20da04d1cc9ff07427e104c7dacc237b61a364a41c7e8855a14b3706b63a2beb6290bf0f4f2379a6b6901
-
SSDEEP
393216:hxAlndYX5fT6K4/m3pFFqyoBgsSzUG9TRx7:MldYX5fWK4Ky1HGRRx7
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
luna_new.exepid process 956 luna_new.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll upx \Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
luna_new.exedescription pid process target process PID 1712 wrote to memory of 956 1712 luna_new.exe luna_new.exe PID 1712 wrote to memory of 956 1712 luna_new.exe luna_new.exe PID 1712 wrote to memory of 956 1712 luna_new.exe luna_new.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dllFilesize
1.4MB
MD5bbcb74867bd3f8a691b1f0a394336908
SHA1aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA256800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
SHA51200745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
-
\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dllFilesize
1.4MB
MD5bbcb74867bd3f8a691b1f0a394336908
SHA1aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA256800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
SHA51200745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
-
memory/956-55-0x0000000000000000-mapping.dmp
-
memory/956-59-0x000007FEF5F70000-0x000007FEF63DE000-memory.dmpFilesize
4.4MB
-
memory/1712-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmpFilesize
8KB