Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
01/06/2024, 04:18
General
- Target Lunar Release/Lunar Release V1.2.exe
- Size 4.8MB
- Sample240601-ew76nahf9t
- SHA256 6a7eff69ef4f70f363c1585dedfbcd76708577e78e292c62203a758f8ae377b3
Malware Config
Extracted
-
xworm
-
91.92.241.69:5555
-
Install_directory
%AppData%
-
install_file
AMD Graphics Manager.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Modifies security service 2 TTPs 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 9 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Sets service image path in registry 2 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Drops startup file 2 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 21 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 22 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 6 IoCs
- Launches sc.exe 18 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
- Drops file in System32 directory
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {45C679CB-5B77-47F3-9765-4E8BB1E31A4B} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
-
C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exeC:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exeC:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\dialer.exedialer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe"C:\Users\Admin\AppData\Local\Temp\Lunar Release\Lunar Release V1.2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe"C:\Users\Admin\AppData\Local\Temp\Windows Sound Adapter.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"C:\Users\Admin\AppData\Local\Temp\zpakjb.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe"C:\Users\Admin\AppData\Local\Temp\LunarExecutor.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\num2.EXE"C:\Users\Admin\AppData\Local\Temp\num2.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "HDNFMUHS"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "HDNFMUHS"5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "YWZWALUU"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "YWZWALUU"5⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-6326472124916531921847896149-2091483932189129920510380141754238702-1253524409"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-23097492880803816-1358032847-1960672110681194711390647647-650876018537480427"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "282218998861667838415083388-1238744921-114117622-196742679118462037011348189542"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-7147283889080831041741299947-27956229651768040211108451110780285131637554560"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-14360423371261684366-66117701910400583871121131861814115432-915725919-391823980"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "313889541200128222-20080771541612704374-1388164577-39979168-137424043-1772855405"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "13436483421878006620546719780181040181-13878342281817936938-20757748-1752906916"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1666473985-8337606046395682088562870521027711789543135170-13071317401134580124"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1364041648-555175473-7806759441617815069839832868-1973975336-1501680884302697934"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1332237246-1649294900-2112671856-1952574740-10408600771883674268-890833771-1008735711"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-381938930-107167682-148765511-55369428813547334701641595235285375817-993982181"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-162701195-1740089095-411702300444126329-1000274302-143603283115985521150563057"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-20211372887856982254890170921422202661655538946-539722721-1346520221179902697"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1963696509-20054230538523116391479180814742532931652808569956633573-476600201"1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
python312.dll
ucrtbase.dll
perfc007.dat
perfc00A.dat
perfc00C.dat
perfc010.dat
perfc011.dat
perfh007.dat
perfh009.dat
perfh00A.dat
perfh00C.dat
perfh010.dat
perfh011.dat
WmiApRpl.h
WmiApRpl.ini
MicrosoftEdgeUpdater.exe
jhi_service.exe
LunarExecutor.exe
Windows Sound Adapter.exe
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-timezone-l1-1-0.dll
num2.EXE
zpakjb.exe
memory/432-90-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp
memory/432-85-0x0000000000610000-0x0000000000634000-memory.dmp
memory/432-89-0x0000000000BB0000-0x0000000000BDB000-memory.dmp
memory/432-91-0x0000000037CC0000-0x0000000037CD0000-memory.dmp
memory/432-83-0x0000000000610000-0x0000000000634000-memory.dmp
memory/476-93-0x0000000000BA0000-0x0000000000BCB000-memory.dmp
memory/476-94-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp
memory/476-95-0x0000000037CC0000-0x0000000037CD0000-memory.dmp
memory/492-111-0x0000000037CC0000-0x0000000037CD0000-memory.dmp
memory/492-110-0x000007FEBFD20000-0x000007FEBFD30000-memory.dmp
memory/492-109-0x00000000000C0000-0x00000000000EB000-memory.dmp
memory/1860-71-0x00000000022E0000-0x00000000022E8000-memory.dmp
memory/1860-70-0x000000001B4B0000-0x000000001B792000-memory.dmp
memory/2092-398-0x000000001A150000-0x000000001A432000-memory.dmp
memory/2092-403-0x0000000000640000-0x0000000000648000-memory.dmp
memory/2188-17-0x0000000000100000-0x0000000000116000-memory.dmp
memory/2188-629-0x000007FEF6093000-0x000007FEF6094000-memory.dmp
memory/2188-8-0x000007FEF6093000-0x000007FEF6094000-memory.dmp
memory/2564-54-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-49-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-48-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-50-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-52-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-55-0x00000000000B0000-0x00000000000D0000-memory.dmp
memory/2564-56-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-53-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-51-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-62-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-61-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-57-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-58-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-59-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2564-60-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2960-79-0x0000000077B60000-0x0000000077C7F000-memory.dmp
memory/2960-75-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2960-74-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2960-73-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2960-72-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2960-78-0x0000000077C80000-0x0000000077E29000-memory.dmp
memory/2960-77-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2960-80-0x0000000140000000-0x000000014002B000-memory.dmp
memory/3020-39-0x0000000140000000-0x000000014000D000-memory.dmp
memory/3020-40-0x0000000140000000-0x000000014000D000-memory.dmp
memory/3020-41-0x0000000140000000-0x000000014000D000-memory.dmp
memory/3020-46-0x0000000140000000-0x000000014000D000-memory.dmp
memory/3020-42-0x0000000140000000-0x000000014000D000-memory.dmp
memory/3020-43-0x0000000140000000-0x000000014000D000-memory.dmp