Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
16/08/2024, 03:28
Behavioral task
behavioral1
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
Resource
win10v2004-20240802-en
General
- Target Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
- Size 14.2MB
- Sample240816-d1rtsssgne
- SHA256 07266653b14ff50a02d0be770e90e102d766cede26e92bd43eb61255c5931fca
- MD5 11afed49123fd774af33550dae13777a
- SHA1 f02c2409c589f76a1639cef002dda5f7f538e98d
- SHA512 303d1eae5e242b0c831bf235705e57d0cb92c65387d7fe7279da364100f402c2212f48972cb6dbb64c951c704ebbd7af2081164bc8884b79064d2ba15e16fd55
- SSDEEP 393216:Hu7L/qdQusl7Q+q9RoWOv+9fav+NNxDnDz:HCLydQu2QdborvSiv+DxDD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2616 Moon Predictor V2 (1).exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2616 1672 Moon Predictor V2 (1).exe 31 PID 1672 wrote to memory of 2616 1672 Moon Predictor V2 (1).exe 31 PID 1672 wrote to memory of 2616 1672 Moon Predictor V2 (1).exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main\Moon-Predictor-v2\Moon Predictor V2 (1).exe"C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main\Moon-Predictor-v2\Moon Predictor V2 (1).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main\Moon-Predictor-v2\Moon Predictor V2 (1).exe"C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main\Moon-Predictor-v2\Moon Predictor V2 (1).exe"2⤵
- Loads dropped DLL
PID:2616
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16722\python310.dll
- Size 4.3MB
- SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
- MD5 deaf0c0cc3369363b800d2e8e756a402
- SHA1 3085778735dd8badad4e39df688139f4eed5f954
- SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
- SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
- MD5 SHA1 SHA512 SSDEEP