Analysis
-
max time kernel
12s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 19:45
Behavioral task
behavioral1
Sample
Lunar.exe
Resource
win7-20240221-en
General
-
Target
Lunar.exe
-
Size
8.2MB
-
MD5
22136d3a26c6286623ab5b220e6bd4ce
-
SHA1
c1226714ad6e9263dcf20025b206182863415358
-
SHA256
08db4a9e051375d4a0f5516b4159e8dc0c0f46f58305dc9e4eceaaa9250b4ba7
-
SHA512
0e246f0a3dc90793169567c398d5ebc94224d93bc065aa89a44dc7ee1893318521f88cb2c8158f42b84fdcec3b7b1ff20518416aed1b49eee54751d8f3b33569
-
SSDEEP
196608:ersk0JI9VzurErvI9pWjgfPvzm6gsQXCYEB4Aul:MqgJurEUWjC3zD2yY84Aul
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
Lunar.exepid process 2676 Lunar.exe 2676 Lunar.exe 2676 Lunar.exe 2676 Lunar.exe 2676 Lunar.exe 2676 Lunar.exe 2676 Lunar.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI13682\python311.dll upx behavioral1/memory/2676-75-0x000007FEF62F0000-0x000007FEF68E2000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Lunar.exedescription pid process target process PID 1368 wrote to memory of 2676 1368 Lunar.exe Lunar.exe PID 1368 wrote to memory of 2676 1368 Lunar.exe Lunar.exe PID 1368 wrote to memory of 2676 1368 Lunar.exe Lunar.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5b59d773b0848785a76baba82d3f775fa
SHA11b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82
SHA2560dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0
SHA512cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26
-
Filesize
20KB
MD54c9bf992ae40c7460a029b1046a7fb5e
SHA179e13947af1d603c964cce3b225306cadff4058b
SHA25618655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4
SHA512c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8
-
Filesize
20KB
MD5d399c926466f044f183faa723ba59120
SHA1a9534b4910888d70eefba6fcc3376f2549cb4a05
SHA25619b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1
SHA512fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057
-
Filesize
20KB
MD5ea5f768b9a1664884ae4ae62cec90678
SHA1ae08e80431da7f4e8f1e5457c255cc360ef1cac0
SHA25624f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d
SHA512411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c
-
Filesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311
-
Filesize
1.1MB
MD5b0397bb83c9d579224e464eebf40a090
SHA181efdfe57225dfe581aafb930347535f08f2f4ce
SHA256d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66
SHA512e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3
-
Filesize
20KB
MD59d8e7a90dd0d54b7ccde435b977ee46d
SHA115cd12089c63f4147648856b16193cf014e6764f
SHA256dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6
SHA512339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b