dcd545a46db449c72af3ace7b783e36d3b0dbaa9a3130678859db44ae8b52b66

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Moon.exe
Size

10.1MB
MD5

bd60ead7adaf5a1ca5f5c2885c35f0f4
SHA1

d5a6852b0f85a46e69ca33e12a54f8b1a565aa54
SHA256

dcd545a46db449c72af3ace7b783e36d3b0dbaa9a3130678859db44ae8b52b66
SHA512

d044ba30d45aed6418c779b53a10e32172f5e50c5008155bf84043651596651f7cd8d672b157711362ed7b8778e0a7dac493c0618fcccc35667328bd19f9962c
SSDEEP

196608:gsnzviaIB5+X5uVChK8iEIcn1dk0x9MSA63Oy45jBgt8c8I:gz5+XKChKmII1Hbx74x2t4I

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2436	Moon.exe

Loads dropped DLL 2 IoCs

pid	Process
1820	Moon.exe
2436	Moon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2436	1820	Moon.exe	29
PID 1820 wrote to memory of 2436	1820	Moon.exe	29
PID 1820 wrote to memory of 2436	1820	Moon.exe	29

C:\Users\Admin\AppData\Local\Temp\Moon.exe
"C:\Users\Admin\AppData\Local\Temp\Moon.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\onefile_1820_133689018813656000\Moon.exe
  "C:\Users\Admin\AppData\Local\Temp\Moon.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1820_133689018813656000\Moon.exe

Filesize
19.3MB

MD5
39a5b67bd07304ebad9ee1970d1ba6e4

SHA1
ee135c93b90e37ba4958f1b29a5f9b746c5e6fb8

SHA256
ed620d1ec8596906654eb395b20b26a1e43a8e2ca0128278206b7b4b884dd327

SHA512
4b049398b7aab8c038fb68478b0ed54989662f974dc2aa9ef11334fe85a4619f1c8b7938f137c31e04c33e75799cc3a1b7f8d56481def7e48bf746a383082c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1820_133689018813656000\python312.dll

Filesize
6.7MB

MD5
550288a078dffc3430c08da888e70810

SHA1
01b1d31f37fb3fd81d893cc5e4a258e976f5884f

SHA256
789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d

SHA512
7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723

Download Submit
memory/1820-57-0x000000013F520000-0x000000013FF4C000-memory.dmp

Filesize
10.2MB

Download
memory/2436-31-0x000000013F1F0000-0x000000014057D000-memory.dmp

Filesize
19.6MB

Download