Overview
overview
4Static
static
3lunar-clie..._3.exe
windows11-21h2-x64
4$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
1$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...nt.exe
windows11-21h2-x64
4$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
1744s -
max time network
1753s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-06-2024 11:57
Static task
static1
Behavioral task
behavioral1
Sample
lunar-client-v3_2_3.exe
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
$R0/Uninstall Lunar Client.exe
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240611-en
General
-
Target
$PLUGINSDIR/INetC.dll
-
Size
238KB
-
MD5
38caa11a462b16538e0a3daeb2fc0eaf
-
SHA1
c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
-
SHA256
ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
-
SHA512
777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1
-
SSDEEP
3072:hD2ekNFXiQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0L:hD2vhaqoDfb6mxk2LqHXj3if/Pa
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3184 4012 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4852 wrote to memory of 4012 4852 rundll32.exe rundll32.exe PID 4852 wrote to memory of 4012 4852 rundll32.exe rundll32.exe PID 4852 wrote to memory of 4012 4852 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#12⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 4803⤵
- Program crash
PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4012 -ip 40121⤵PID:2836