Overview

overview

8

Static

static

5

Luna.exe

windows7-x64

5

Luna.exe

windows10-2004-x64

8

out.exe

windows7-x64

out.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Luna.exe

  • Size

    5.5MB

  • Sample

    241005-b6ds1sybnm

  • MD5

    22996c606858093177dd317f663eb7ac

  • SHA1

    92e839133d58a2c37bec64054282dedfb4d2a189

  • SHA256

    dcbc6430a729204d686ca213555046c127f86eb08512a2688438669fd74e253a

  • SHA512

    41a4688ba71379c65387c9f2b59f132abe25130c7ccf2844c8002479916e2240ac07234350e334826824e296dd3da2c49249e06cc52e524b0d9995e4496d6a70

  • SSDEEP

    98304:ym1dNSBf481cnZjmg2NboVaNY+gxNlJ/iOkNuzuy7REg/xjxfHGv3M+ErI:ymvNSBf/1KFl21oVaZivKuzrFFxjdHG+

Score
8/10
discoverypersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      Luna.exe

    • Size

      5.5MB

    • MD5

      22996c606858093177dd317f663eb7ac

    • SHA1

      92e839133d58a2c37bec64054282dedfb4d2a189

    • SHA256

      dcbc6430a729204d686ca213555046c127f86eb08512a2688438669fd74e253a

    • SHA512

      41a4688ba71379c65387c9f2b59f132abe25130c7ccf2844c8002479916e2240ac07234350e334826824e296dd3da2c49249e06cc52e524b0d9995e4496d6a70

    • SSDEEP

      98304:ym1dNSBf481cnZjmg2NboVaNY+gxNlJ/iOkNuzuy7REg/xjxfHGv3M+ErI:ymvNSBf/1KFl21oVaZivKuzrFFxjdHG+

    Score
    8/10
    upxdiscoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      out.upx

    • Size

      16.4MB

    • MD5

      d1537b04b26553caf92a77eb1df856ab

    • SHA1

      8fb00f505ac39eedec40403a758b5f6da4fe1160

    • SHA256

      47620392b5bc1bc37b02466867c800995a71cf2d1ffc31123f913122036f6184

    • SHA512

      906afa89a8a3e9ae5927c45537976b34407de8e4456a4fc60917a637173b81b5288a87e1daa9bea7a8712c39c773985e44f4cacca5098d071fb07ecc4f594643

    • SSDEEP

      98304:i6bBPUTtMezoxvV5OyAjDSraICjE5krIIYIo/moGRX35FRmfqiK9QYlg:i6KJvzoxJGSVOreypiWuY

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks