Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 13:40
Behavioral task
behavioral1
Sample
Lunar.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Lunar.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
u��[i%.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
u��[i%.pyc
Resource
win10v2004-20240508-en
General
-
Target
Lunar.exe
-
Size
7.4MB
-
MD5
0440d83abe7fc137d4d84cfa898b0ad6
-
SHA1
a65a5b1c2e4857caabac6ec807b7bafc703b853e
-
SHA256
ff3dc906d1b5b35c7aede0734ff89fd262433bc9ac208f5b19239912b5b503ef
-
SHA512
3491726720d68b5533fca3dc6d71f4a9a809e33485dd408317d7f4b3816aa9808e7c79f3b88df10f4fc5ce79eb9fa5f627b68ea96408429367f9fd9f62f856b8
-
SSDEEP
196608:BreJYS6jpOshoKMuIkhVastRL5Di3uh1D7JC:mYS4OshouIkPftRL54YRJC
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Lunar.exepid process 2548 Lunar.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI17722\python311.dll upx behavioral1/memory/2548-23-0x000007FEF60A0000-0x000007FEF6689000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Lunar.exedescription pid process target process PID 1772 wrote to memory of 2548 1772 Lunar.exe Lunar.exe PID 1772 wrote to memory of 2548 1772 Lunar.exe Lunar.exe PID 1772 wrote to memory of 2548 1772 Lunar.exe Lunar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lunar.exe"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\Lunar.exe"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"2⤵
- Loads dropped DLL
PID:2548
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2708
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI17722\python311.dllFilesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
memory/2548-23-0x000007FEF60A0000-0x000007FEF6689000-memory.dmpFilesize
5.9MB