Analysis Overview
SHA256
616d6444f37c7e64a365cf12e0778e1be4025e71acfe9168c57b6ee62dcab3d5
Threat Level: Shows suspicious behavior
The file luna.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Unsigned PE
Detects Pyinstaller
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-10 17:17
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-10 17:17
Reported
2024-05-10 17:20
Platform
win7-20240221-en
Max time kernel
122s
Max time network
124s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1976 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Users\Admin\AppData\Local\Temp\luna.exe |
| PID 1976 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Users\Admin\AppData\Local\Temp\luna.exe |
| PID 1976 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Users\Admin\AppData\Local\Temp\luna.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\luna.exe
"C:\Users\Admin\AppData\Local\Temp\luna.exe"
C:\Users\Admin\AppData\Local\Temp\luna.exe
"C:\Users\Admin\AppData\Local\Temp\luna.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI19762\python311.dll
| MD5 | a72993488cecd88b3e19487d646f88f6 |
| SHA1 | 5d359f4121e0be04a483f9ad1d8203ffc958f9a0 |
| SHA256 | aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038 |
| SHA512 | c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-10 17:17
Reported
2024-05-10 17:18
Platform
win10v2004-20240426-en
Max time kernel
15s
Max time network
17s
Command Line
Signatures
Loads dropped DLL
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2708 wrote to memory of 3252 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Users\Admin\AppData\Local\Temp\luna.exe |
| PID 2708 wrote to memory of 3252 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Users\Admin\AppData\Local\Temp\luna.exe |
| PID 3252 wrote to memory of 1248 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Windows\system32\cmd.exe |
| PID 3252 wrote to memory of 1248 | N/A | C:\Users\Admin\AppData\Local\Temp\luna.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\luna.exe
"C:\Users\Admin\AppData\Local\Temp\luna.exe"
C:\Users\Admin\AppData\Local\Temp\luna.exe
"C:\Users\Admin\AppData\Local\Temp\luna.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| BE | 88.221.83.219:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 219.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| BE | 88.221.83.219:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI27082\python311.dll
| MD5 | a72993488cecd88b3e19487d646f88f6 |
| SHA1 | 5d359f4121e0be04a483f9ad1d8203ffc958f9a0 |
| SHA256 | aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038 |
| SHA512 | c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\libffi-8.dll
| MD5 | d86a9d75380fab7640bb950aeb05e50e |
| SHA1 | 1c61aaf9022cd1f09a959f7b2a65fb1372d187d7 |
| SHA256 | 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b |
| SHA512 | 18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_lzma.pyd
| MD5 | 3230404a7191c6228a8772d3610e49e5 |
| SHA1 | 4e8e36c89b4ff440ddff9a5b084b262c9b2394ec |
| SHA256 | 33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903 |
| SHA512 | 6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\select.pyd
| MD5 | 116335ebc419dd5224dd9a4f2a765467 |
| SHA1 | 482ef3d79bfd6b6b737f8d546cd9f1812bd1663d |
| SHA256 | 813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4 |
| SHA512 | 41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_queue.pyd
| MD5 | 045ef55136b1e580582199b3399267a2 |
| SHA1 | de54519c67a996d0a8b4164417058f4610a57376 |
| SHA256 | 39bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582 |
| SHA512 | 7b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\pywin32_system32\pythoncom311.dll
| MD5 | f98264f2dacfc8e299391ed1180ab493 |
| SHA1 | 849551b6d9142bf983e816fef4c05e639d2c1018 |
| SHA256 | 0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b |
| SHA512 | 6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\VCRUNTIME140_1.dll
| MD5 | bba9680bc310d8d25e97b12463196c92 |
| SHA1 | 9a480c0cf9d377a4caedd4ea60e90fa79001f03a |
| SHA256 | e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab |
| SHA512 | 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\win32api.pyd
| MD5 | 1d6762b494dc9e60ca95f7238ae1fb14 |
| SHA1 | aa0397d96a0ed41b2f03352049dafe040d59ad5d |
| SHA256 | fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664 |
| SHA512 | 0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\pywin32_system32\pywintypes311.dll
| MD5 | 90b786dc6795d8ad0870e290349b5b52 |
| SHA1 | 592c54e67cf5d2d884339e7a8d7a21e003e6482f |
| SHA256 | 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a |
| SHA512 | c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_socket.pyd
| MD5 | 0fc65ec300553d8070e6b44b9b23b8c0 |
| SHA1 | f8db6af578cf417cfcddb2ed798c571c1abd878f |
| SHA256 | 360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c |
| SHA512 | cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\pyexpat.pyd
| MD5 | 4378685011241d01248dd60fc9cb5436 |
| SHA1 | d754286af98f5ae2ee82883669d509e105413ed1 |
| SHA256 | 867012edb8a6acd2131c4698b69bb94e6ba07607035e7c621aaa24262817e55b |
| SHA512 | f9ed5957de5846b97cd8dc8ef8cf876b3192c03afd148541053b31d1237ead67ca287dc95e109b70305a3eb1422d32d6bec1cd7598c79c718469d88ac2e82575 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_ssl.pyd
| MD5 | 93905020f4158c5119d16ee6792f8057 |
| SHA1 | eb613c31f26ed6d80681815193ffafdf30314a07 |
| SHA256 | d9cc4358d9351fed11eec03753a8fa8ed981a6c2246bbd7cb0b0a3472c09fdc4 |
| SHA512 | 0de43b4fafdd39eaaff6cab613708d56b697c0c17505e4132d652fb3f878c2114f5e682745a41219193c75e783aede524685b77bd31620f8afe9c7b250f92609 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\libssl-1_1.dll
| MD5 | 8769adafca3a6fc6ef26f01fd31afa84 |
| SHA1 | 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6 |
| SHA256 | 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071 |
| SHA512 | fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\libcrypto-1_1.dll
| MD5 | 6f4b8eb45a965372156086201207c81f |
| SHA1 | 8278f9539463f0a45009287f0516098cb7a15406 |
| SHA256 | 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541 |
| SHA512 | 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_overlapped.pyd
| MD5 | f7a6519fd517ad2426b05ef9dccd31f6 |
| SHA1 | 32b8df120ca2cfeb8349c1675c0907fd2132c76b |
| SHA256 | 6f79a76094f43c55899fe804cdd5d44ba6ff920c651436a7effa30e7c01b96ec |
| SHA512 | 2de7f8302743f36c21a6e3442960976a63396b93201f63579aa507274571fab801e228edc67a83d7729b6473d4b2899f0a9ae1b0a8b4e278d3b802eb896432dd |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_asyncio.pyd
| MD5 | 47de17275c73cfcdce18ace16cd4f355 |
| SHA1 | 5d6b9b1d4534eeae0a3b72bfa359bb4818e4c86e |
| SHA256 | d667822030ba160cd8770569afec2c029b5247ceaa401d9268fe98bbea9e4c11 |
| SHA512 | e11637808ddaf14d0abdb88a389e6947b16f272d97642312c99ec38bbcaf43e3594d8f89bc8699d769368704a81bc1f01edffa69ab736665c1c192aeed780c8f |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_bz2.pyd
| MD5 | 10d42efac304861ad19821b4594fa959 |
| SHA1 | 1a65f60bba991bc7e9322af1e19f193dae76d77a |
| SHA256 | 8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14 |
| SHA512 | 3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\sqlite3.dll
| MD5 | d0ffe8df8de72e18c2f08ad813d3a532 |
| SHA1 | a628abdf6f7f0e124bfb9bc88f451bb2ede76e21 |
| SHA256 | 2b86d45728aa3def8ee9f3b150b1b5ee89aa26f5ed2b5509c8f9fa1c8b5c7b1b |
| SHA512 | 27be68c790a18477b315204bbd655a8e8101c26931474d955932140b9e1e887f7463a60f13c5b5883e04d7a80f87be64ab0ebd315b53533c7fb9530800627df1 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_sqlite3.pyd
| MD5 | 57f807639dd032d6209b6a2a0622aa9f |
| SHA1 | d020e47b327a4a08afcacd29d2d944d3efcd3053 |
| SHA256 | 07caa7a57f68c126c9039b27536c8710be1a0e2779843247e26c85138ec2094f |
| SHA512 | d5e81f9acf04e1d8bb9f4554746e0a16b754836c4c43f887af91f6d4e758f69073abd8cd1ddbd192d61f7fab4eef62b83200d7ffe97c50ea4905b30ee6481fc3 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\_ctypes.pyd
| MD5 | df6be515e183a0e4dbe9cdda17836664 |
| SHA1 | a5e8796189631c1aaca6b1c40bc5a23eb20b85db |
| SHA256 | af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee |
| SHA512 | b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\python3.dll
| MD5 | 7feb3da304a2fead0bb07d06c6c6a151 |
| SHA1 | ee4122563d9309926ba32be201895d4905d686ce |
| SHA256 | ddd2c77222e2c693ef73d142422d6bf37d6a37deead17e70741b0ac5c9fe095b |
| SHA512 | 325568bcf1835dd3f454a74012f5d7c6877496068ad0c2421bf65e0640910ae43b06e920f4d0024277eee1683f0ce27959843526d0070683da0c02f1eac0e7d2 |
C:\Users\Admin\AppData\Local\Temp\_MEI27082\base_library.zip
| MD5 | c2519c672dd97aa31da47d75dc1ae68c |
| SHA1 | df2fcb79ebb0903fd0e27506a6ee05f1b87cbf7a |
| SHA256 | c980c49f384d0af89c442229c1707e743f548efecb9dc021ac3138da4dfab65b |
| SHA512 | 149d9361cb760cd74b55cf6343ad68bed34199e42aa59e85b89a6393c11e4a61808bc354cecac49db9cc6839babe1c703535d3b8c9ffb2345038d9ab015cb303 |