Analysis
- max time kernel
61s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 20:21
Behavioral task
behavioral1
Sample
XMoon.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
XMoon.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target XMoon.exe
- Size 669KB
- Sample260730-y45v2sfb26
- SHA256 ea0a5854aa6e91ebe816d256f34f820697a92d86b4f81e8855c84daeed40b9d4
- MD5 a690cce59e21f5198ca304243b084f9e
- SHA1 8aeb0b106dd21e2afb50c3f7ae78ca4f8f4b29c5
- SHA512 9e0eebf53d0ea424ae9aeb0da2e27e5be75391a5be2945d29137da12baff32184df3a223692bbabb4b64350d902bd6847284d982e62313f3402035e842f4b758
- SSDEEP 12288:X6Wq4aaE6KwyF5L0Y2D1PqL6eqhBkEFY9ddNdzYaTW3aSDcyImRlL7zo:1thEVaPqL6JkF9YaTLSigL7c
- TLSH T1B9E4EFA7717CC4E2F8AC3EF1564853229AB02E924278F55BE00FBED6E8B7113D8595C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroCop.lnk XMoon.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: XMoon.exe File opened (read-only) \??\u: XMoon.exe File opened (read-only) \??\v: XMoon.exe File opened (read-only) \??\g: XMoon.exe File opened (read-only) \??\i: XMoon.exe File opened (read-only) \??\o: XMoon.exe File opened (read-only) \??\y: XMoon.exe File opened (read-only) \??\z: XMoon.exe File opened (read-only) \??\h: XMoon.exe File opened (read-only) \??\j: XMoon.exe File opened (read-only) \??\k: XMoon.exe File opened (read-only) \??\l: XMoon.exe File opened (read-only) \??\w: XMoon.exe File opened (read-only) \??\x: XMoon.exe File opened (read-only) \??\d: XMoon.exe File opened (read-only) \??\n: XMoon.exe File opened (read-only) \??\p: XMoon.exe File opened (read-only) \??\s: XMoon.exe File opened (read-only) \??\a: XMoon.exe File opened (read-only) \??\b: XMoon.exe File opened (read-only) \??\m: XMoon.exe File opened (read-only) \??\q: XMoon.exe File opened (read-only) \??\r: XMoon.exe - AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4360-171-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-172-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-173-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-174-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-175-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-176-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral2/memory/4360-177-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1236 WScript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg" XMoon.exe -
resource yara_rule behavioral2/memory/4360-0-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-171-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-172-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-173-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-174-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-175-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-176-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/4360-177-0x0000000000400000-0x0000000000506000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3460 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMoon.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop XMoon.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings XMoon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe 4360 XMoon.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4360 wrote to memory of 3460 4360 XMoon.exe 89 PID 3460 wrote to memory of 3884 3460 cmd.exe 91 PID 4360 wrote to memory of 1236 4360 XMoon.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\XMoon.exe"C:\Users\Admin\AppData\Local\Temp\XMoon.exe"1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\wusa.exewusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\3⤵PID:3884
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1236
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\888.vbs
- Size 280B
- SHA256 35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e
- MD5 8be57121a3ecae9c90cce4adf00f2454
- SHA1 aca585c1b6409bc2475f011a436b319e42b356d8
- SHA512 85521f6cd62dd5bb848933a188a9ddb83dd7ae2c5f4a97b65ba7785c3d58dba27694c7df308f4cf0fdaaa8c55251ff14ed1632e315a16d8d0b15217bac381f72
- TLSH T1DDD0EB20430EC8A5F0E06010A06F8054DB73F01D3290B23001E4B044D31038BCAB88E3
- MD5 SHA1 SHA512 TLSH