Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 17:17
Behavioral task
behavioral1
Sample
luna.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
luna.exe
Resource
win10v2004-20240426-en
General
-
Target
luna.exe
-
Size
31.9MB
-
MD5
95178e9baece6c3ca37d61d9c150c24d
-
SHA1
5e855b41290245c7cb3dfccdfbebf887f7bfac83
-
SHA256
616d6444f37c7e64a365cf12e0778e1be4025e71acfe9168c57b6ee62dcab3d5
-
SHA512
bf484652812738d489742627eba0078e5e4f2a61488738fc7ff9657f1f4b9deeb292c228d7cf8b5f196805886e48d2b32a22d0f942291477294c78192e47dc64
-
SSDEEP
786432:i2zzdQ4OHzeMKVxzx5cjQb9JC8eTs3/5:i2zzVOHzDCd5cjQbr+c5
Malware Config
Signatures
-
Loads dropped DLL 24 IoCs
pid Process 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe 3252 luna.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2708 wrote to memory of 3252 2708 luna.exe 86 PID 2708 wrote to memory of 3252 2708 luna.exe 86 PID 3252 wrote to memory of 1248 3252 luna.exe 87 PID 3252 wrote to memory of 1248 3252 luna.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\luna.exe"C:\Users\Admin\AppData\Local\Temp\luna.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\luna.exe"C:\Users\Admin\AppData\Local\Temp\luna.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:1248
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
62KB
MD547de17275c73cfcdce18ace16cd4f355
SHA15d6b9b1d4534eeae0a3b72bfa359bb4818e4c86e
SHA256d667822030ba160cd8770569afec2c029b5247ceaa401d9268fe98bbea9e4c11
SHA512e11637808ddaf14d0abdb88a389e6947b16f272d97642312c99ec38bbcaf43e3594d8f89bc8699d769368704a81bc1f01edffa69ab736665c1c192aeed780c8f
-
Filesize
81KB
MD510d42efac304861ad19821b4594fa959
SHA11a65f60bba991bc7e9322af1e19f193dae76d77a
SHA2568eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14
SHA5123f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae
-
Filesize
120KB
MD5df6be515e183a0e4dbe9cdda17836664
SHA1a5e8796189631c1aaca6b1c40bc5a23eb20b85db
SHA256af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
SHA512b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253
-
Filesize
153KB
MD53230404a7191c6228a8772d3610e49e5
SHA14e8e36c89b4ff440ddff9a5b084b262c9b2394ec
SHA25633ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903
SHA5126ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b
-
Filesize
48KB
MD5f7a6519fd517ad2426b05ef9dccd31f6
SHA132b8df120ca2cfeb8349c1675c0907fd2132c76b
SHA2566f79a76094f43c55899fe804cdd5d44ba6ff920c651436a7effa30e7c01b96ec
SHA5122de7f8302743f36c21a6e3442960976a63396b93201f63579aa507274571fab801e228edc67a83d7729b6473d4b2899f0a9ae1b0a8b4e278d3b802eb896432dd
-
Filesize
30KB
MD5045ef55136b1e580582199b3399267a2
SHA1de54519c67a996d0a8b4164417058f4610a57376
SHA25639bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582
SHA5127b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c
-
Filesize
76KB
MD50fc65ec300553d8070e6b44b9b23b8c0
SHA1f8db6af578cf417cfcddb2ed798c571c1abd878f
SHA256360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c
SHA512cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8
-
Filesize
115KB
MD557f807639dd032d6209b6a2a0622aa9f
SHA1d020e47b327a4a08afcacd29d2d944d3efcd3053
SHA25607caa7a57f68c126c9039b27536c8710be1a0e2779843247e26c85138ec2094f
SHA512d5e81f9acf04e1d8bb9f4554746e0a16b754836c4c43f887af91f6d4e758f69073abd8cd1ddbd192d61f7fab4eef62b83200d7ffe97c50ea4905b30ee6481fc3
-
Filesize
155KB
MD593905020f4158c5119d16ee6792f8057
SHA1eb613c31f26ed6d80681815193ffafdf30314a07
SHA256d9cc4358d9351fed11eec03753a8fa8ed981a6c2246bbd7cb0b0a3472c09fdc4
SHA5120de43b4fafdd39eaaff6cab613708d56b697c0c17505e4132d652fb3f878c2114f5e682745a41219193c75e783aede524685b77bd31620f8afe9c7b250f92609
-
Filesize
1.7MB
MD5c2519c672dd97aa31da47d75dc1ae68c
SHA1df2fcb79ebb0903fd0e27506a6ee05f1b87cbf7a
SHA256c980c49f384d0af89c442229c1707e743f548efecb9dc021ac3138da4dfab65b
SHA512149d9361cb760cd74b55cf6343ad68bed34199e42aa59e85b89a6393c11e4a61808bc354cecac49db9cc6839babe1c703535d3b8c9ffb2345038d9ab015cb303
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
37KB
MD5d86a9d75380fab7640bb950aeb05e50e
SHA11c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA25668fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
SHA51218437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
193KB
MD54378685011241d01248dd60fc9cb5436
SHA1d754286af98f5ae2ee82883669d509e105413ed1
SHA256867012edb8a6acd2131c4698b69bb94e6ba07607035e7c621aaa24262817e55b
SHA512f9ed5957de5846b97cd8dc8ef8cf876b3192c03afd148541053b31d1237ead67ca287dc95e109b70305a3eb1422d32d6bec1cd7598c79c718469d88ac2e82575
-
Filesize
64KB
MD57feb3da304a2fead0bb07d06c6c6a151
SHA1ee4122563d9309926ba32be201895d4905d686ce
SHA256ddd2c77222e2c693ef73d142422d6bf37d6a37deead17e70741b0ac5c9fe095b
SHA512325568bcf1835dd3f454a74012f5d7c6877496068ad0c2421bf65e0640910ae43b06e920f4d0024277eee1683f0ce27959843526d0070683da0c02f1eac0e7d2
-
Filesize
5.5MB
MD5a72993488cecd88b3e19487d646f88f6
SHA15d359f4121e0be04a483f9ad1d8203ffc958f9a0
SHA256aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038
SHA512c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38
-
Filesize
654KB
MD5f98264f2dacfc8e299391ed1180ab493
SHA1849551b6d9142bf983e816fef4c05e639d2c1018
SHA2560fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b
SHA5126bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c
-
Filesize
131KB
MD590b786dc6795d8ad0870e290349b5b52
SHA1592c54e67cf5d2d884339e7a8d7a21e003e6482f
SHA25689f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
SHA512c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72
-
Filesize
28KB
MD5116335ebc419dd5224dd9a4f2a765467
SHA1482ef3d79bfd6b6b737f8d546cd9f1812bd1663d
SHA256813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4
SHA51241dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3
-
Filesize
1.4MB
MD5d0ffe8df8de72e18c2f08ad813d3a532
SHA1a628abdf6f7f0e124bfb9bc88f451bb2ede76e21
SHA2562b86d45728aa3def8ee9f3b150b1b5ee89aa26f5ed2b5509c8f9fa1c8b5c7b1b
SHA51227be68c790a18477b315204bbd655a8e8101c26931474d955932140b9e1e887f7463a60f13c5b5883e04d7a80f87be64ab0ebd315b53533c7fb9530800627df1
-
Filesize
130KB
MD51d6762b494dc9e60ca95f7238ae1fb14
SHA1aa0397d96a0ed41b2f03352049dafe040d59ad5d
SHA256fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664
SHA5120b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00