Analysis
-
max time kernel
58s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-08-2024 18:48
General
-
Target
Lunar_Launcher.exe
-
Size
3.2MB
-
MD5
e6810402c4da84354ed06ad83ba5ffa8
-
SHA1
5d34d41750a512ffbbc49613acdea9ed7d3cc2f5
-
SHA256
9984c879995a1ac07533eba9f8ccfb88b82e81c010331ea46a52427395cd7d06
-
SHA512
38e185c2cf8fdf5baa3005f6562742f080260f16b202a2a75b9ed749631853f199543dabc7a96f8488198ad9fdebef1704a891f34ca675ae47179bcfb1ee532d
-
SSDEEP
98304:gwyrkJci8kn0p9zCFm0kR2wum3yMyRGBVMaGjTzJmg:PygJci8kK9zC80DmsuVEjTzIg
Malware Config
Signatures
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lunar_Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Lunar_Launcher.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lunar S.exe"C:\Users\Admin\AppData\Local\Temp\Lunar S.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.3MB
MD536694cca2135f3a80e7edee51d03190a
SHA15089e53dda47e456c9da61b98fe73ce2649e0225
SHA256ca487bad0fa294194e9c966c3e2130b60248d7cc2d34c233a50bb6ae46dcfc5e
SHA512dc341145135140663ea94656604cfa35c1be87012a1ef411d212354e080daa2b45b975c44055c6afa1a86800dd2768ff77249c7ff8744b1c179be72685855da2
-
Filesize
17B
MD5edcdb41da3e255a089e3286b6f392bdf
SHA1446fee990631085500026cdd73bb81a2adaa4548
SHA25663257a9f3e673d8dc24fefd7c21095a0b84ca0fac613acf355727103b158f02d
SHA51231b55154b550002510f6f359f2a8ea6c8c4403d47fec2e8b2024c091cf211f57adefc933819038b2325a14eac26949087f488c154608d163d180db79ca4a4c6f
-
Filesize
526B
MD5b429cc104ce8ce3b36f348cab76d4435
SHA11972ff2bd13840ebcdfb4e22038b57ace7656aed
SHA2564efaeb501e792ae8ad8e75dbce370a9c68763889a48461695156ccb20e62806e
SHA51238a46a53342231cc3e00cc9baa8d8ce31165b8139538124f6bb4adc16530f2efcc97b98533e2141c2a49d8aa5c6cd56718c9cd783e81c83fefc88ca512c34a19
-
Filesize
632KB
MD5317fec7c823a6ba4ad613220b587a0e8
SHA13884e8a9a9122e7912c76c919f20c1b9d274f505
SHA2565573cc6f439511c5ec73b0c88af87bce49cac37475aa32da5b75b931f632a3dc
SHA512d5adc2137051ab321197d0a2261ab991f5bf16e0271485c64b66679d863efb58191fe269fc40aa39feefd380b28d33168a6910b7ec40dedd2974e6d1d2db0bad
-
Filesize
772KB
MD5a39e58e282d7f358148657f364697868
SHA1d0daa24f30aa7ce2e77b9ced33ffa328b306afa9
SHA256694ee92839e98635a3597f19deeabfde45efa44399c08ae9602bab145cc3f141
SHA512242868b3d3494f42a9dba7989149c947d4b2efa93ab277053bf711d4db782e6b8b2af2a7d607105126a2023ca9eaba12259c327d6bc7eb4944e17f99c81b1a76
-
Filesize
66B
MD5ee34b30a428444dd46c632004b5b77fc
SHA11d7e21b3c6773658fa2d3810d34fb72c7a33fcdf
SHA256c3da6449cbccdf23496010f27b5b0b11e605a115ba10478bf3f7ec4c89021298
SHA512262f3677b48035f0a29b727fda7de68bf44bff752e15bf3fdaf74d9f9816050b8cd96cd72f1a39e0996b42bcb7b64545c9111f386ee5a3b7e5a491fc94b08845
-
Filesize
65B
MD58ad7b0baa10fbec03960f028cd0c77e7
SHA1c2384f1eaaad905e273e04b681a973e26958ae83
SHA2563695fac890f7757822c873eafd5288b3b336a216d11b17155617774702af57e5
SHA51217e8721d581301c0f6520752cf70be2a2afa6b13b6af42a07e5d09434e34e47df548079112f89dd267d9ce5e55a65f32209645a4eac2082bef2673d61365298c
-
Filesize
2KB
MD5b7d4143675b533a08c41036c65bb1a99
SHA19dfab0fa6bccbd30135648b407ebb0e5abaabe7d
SHA256bdb7d1fb51886b7b3d955e6058ad9cfce18d745da4e595375c95a3ffc9640a79
SHA512e71883d7c0855b1e50b4d193d18a9bb19fcf0ff2e26b13978e379dd6062b79510f90e0932b2f7196839cb29b9f4218027c3beef7edde5e98d37ef5b13e5c9518
-
Filesize
630B
MD5ad4f05b96d66f66c2e84e5215604e6e4
SHA178d97f41ed4e636a42585edcb9a7f295aff2eb30
SHA25636e30599f3d04e5368f6637631ba0f247db210782fbe56edf942f0dabbe6aa3c
SHA512b8e47cb0f831e8b64eb632eb5b1a81f30b3b45307a26a5b5cb69b5a9dc8f0cb4d97b25d8f8871a1d1e33d8f793d9b2791a710d37b7cd070342e0df33921f196a
-
Filesize
430KB
MD551940272f2b31404bf8117f730abcf8b
SHA1898e0cca063f05bb50155a724d7baf023e318ba6
SHA2566a32640a247ecd1bfc15e5017b6b3f4266b1fe3002d4f6aaf78564ac89f644a1
SHA512d1117df0c892eb3b6e0097376e45b99ebc79c1dc110ab9161a62f323508c71dcbeefdb4d055c0a9776a5fd45f9dc3dde567221be8cbc4b029dae38cbf066e10c
-
Filesize
121B
MD5fcfeae4283d34c4cca075bac0fe5eff3
SHA1d6163e7a64d84e36f6759329fae168ae5e9dacc7
SHA25666f0b49a3b4ec4aaf12853e2dc02d02baa42f3a42881f0dd171cb9a700613cba
SHA512235b7c21043a34615c2b213f9be924cef0c3aeef6fd2c9d59dd135af154d8ccf3be55ba61a47dc7e1df4c26199c1bcce6c3d2058c839e23e31113246612607f4
-
Filesize
442B
MD5fb058c937f0d722e65fdb325a51fb0e8
SHA11420b58a85d3453a5830b4fb1f3320b22c25c4db
SHA2568d5d841f0a39a3095196032818a8065ddea5b9c7dfd492d437157b411e3c9645
SHA51284a68d190a35bc10e1b3d9dde08159526f3994049c31b02861dc563e3a2ef9cb49e4c9189250a1e8b8b743297b41226ce2e827e2daad9fe159b46da67b15daa6
-
Filesize
120KB
MD5a10505e68dcf830f169e85e731fea71b
SHA169b1701e45558c155c156745a92a8f2e3f1adc53
SHA256ca631d1fa26945572f27973e77809e4c0f65befeb237980ce758c4f37eb9e257
SHA5122fc44547072dfc7e173bed221b106c42f3cf2b5b983434b74594d5b26325de2fbacacff1d7592a741b68ace8c1b222c965fbd05fd8ca989d8ce89ed9bfeccd23
-
Filesize
112KB
MD533f7fa1198c0bf4988a0210f144b20b4
SHA106d50e37389480f542c8e15ae2e85106bbe9c304
SHA2568c1b0ae8b7e7aa402407f00f22efb1989e47aeaa9c6a1ffa98341672d9ecf6dc
SHA51209905095729e37f00fde5ce967fb309c8e64c76bf0f6839fa27bede39b91d663684c8de05c16fda63699df73a78a23a60a367a5e9c56366d6c74424506a4454d
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
224KB
-
Filesize
40KB
-
Filesize
3.2MB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
9.3MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB