Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
18-12-2024 17:16
General
-
Target
Moon/MoonBETARUNBOOT.exe
-
Size
135KB
-
MD5
2f4a9e448314620c6395ffeb7b2badf2
-
SHA1
45649c5a62007d47c90ddaa072ba746f04e5fb9b
-
SHA256
23fa7314c51fccaac9a9e79a67951194379ba785f1ef6b3932daa0ad62455eab
-
SHA512
fe882ecb71ab4b2d5ae00ba3cb8ee4e1b1d3f5cfc08ac3bbeb0360b55718f5433a96d1588be792efd0688e8855a3a593d0c79234e4e0eca95ba0bad9bc8530c0
-
SSDEEP
3072:rjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfObhBuU:rjK4TDUqgpqWDLZ5H+xuZ04shA
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Moon\MoonBETARUNBOOT.exe"C:\Users\Admin\AppData\Local\Temp\Moon\MoonBETARUNBOOT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow