Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 04:47

General

  • Target

    LUNAClient.exe

  • Size

    1.5MB

  • MD5

    cf973f6292741a60d0141ce2adfbef5f

  • SHA1

    8370565578cb1969bed2e33061fc4c24a11b2ec0

  • SHA256

    162d893b6c41fdbc7e82ed4e366d846f5da43b90da2e0062d5af48837210f66a

  • SHA512

    3938531937400923e2cfe60127a5ad4407867b055a9dce1a86ee7c24575369b1c591e80d8b6b60f3ddc2ace06c6824db54e403eed51b6c9ab5374f4ef623154b

  • SSDEEP

    24576:C9P5ZJLFSCfo2zJz8e3lKT8KPetq4mfIbJ8GuCFgmWbLilRNQ2MZ:CXZJBS2RNQAlKAKPE2cZImWiBQ7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LUNAClient.exe
    "C:\Users\Admin\AppData\Local\Temp\LUNAClient.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2596-0-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2596-1-0x0000000000320000-0x000000000035D000-memory.dmp

    Filesize

    244KB

  • memory/2596-4-0x00000000760D1000-0x00000000760D2000-memory.dmp

    Filesize

    4KB

  • memory/2596-3-0x0000000077630000-0x0000000077631000-memory.dmp

    Filesize

    4KB

  • memory/2596-2-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2596-5-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/2596-6-0x0000000068000000-0x0000000068012000-memory.dmp

    Filesize

    72KB

  • memory/2596-7-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-10-0x0000000021100000-0x0000000021164000-memory.dmp

    Filesize

    400KB

  • memory/2596-9-0x0000000021100000-0x0000000021164000-memory.dmp

    Filesize

    400KB

  • memory/2596-8-0x0000000068000000-0x0000000068012000-memory.dmp

    Filesize

    72KB

  • memory/2596-22-0x0000000000390000-0x00000000003A9000-memory.dmp

    Filesize

    100KB

  • memory/2596-17-0x0000000000390000-0x00000000003A9000-memory.dmp

    Filesize

    100KB

  • memory/2596-13-0x0000000000390000-0x00000000003A9000-memory.dmp

    Filesize

    100KB

  • memory/2596-11-0x0000000002300000-0x00000000023A5000-memory.dmp

    Filesize

    660KB

  • memory/2596-23-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-25-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-26-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-24-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-27-0x0000000000320000-0x000000000035D000-memory.dmp

    Filesize

    244KB

  • memory/2596-28-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-29-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2596-30-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2596-31-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/2596-32-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/2596-33-0x00000000760C0000-0x00000000761D0000-memory.dmp

    Filesize

    1.1MB