Analysis
- user interaction
yes - max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/10/2026, 23:01
General
- Target LunarLoader/Checker/CarbonChecker.exe
- Size 1.7MB
- Sample261024-2zls6afh85
- SHA256 769f6f0d241428069a1f6fc289a7ed1ebdde6e908bc580d5f6c6f235b6d6389e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information as a root user.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LunarLoader\Checker\CarbonChecker.exe"C:\Users\Admin\AppData\Local\Temp\LunarLoader\Checker\CarbonChecker.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/wmi -ClassName WmiMonitorID | ForEach-Object { $name = [System.Text.Encoding]::ASCII.GetString($_.UserFriendlyName).Trim([char]0); $pc = [System.Text.Encoding]::ASCII.GetString($_.ProductCodeID).Trim([char]0); $sn = [System.Text.Encoding]::ASCII.GetString($_.SerialNumberID).Trim([char]0); '{0}|{1}|{2}' -f $name, $pc, $sn }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetAdapter -Filter 'HardwareInterface=TRUE' | ForEach-Object { $mac = if ($_.MacAddress) { $_.MacAddress } else { $_.PermanentAddress }; '{0}|{1}' -f $_.Name, $mac }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_op0tzdsi.4sb.ps1
memory/5336-53-0x0000021C4C880000-0x0000021C4C933000-memory.dmp
memory/5772-27-0x00000293F1240000-0x00000293F126A000-memory.dmp
memory/5772-30-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-25-0x00000293F1290000-0x00000293F1343000-memory.dmp
memory/5772-26-0x00000293F11E0000-0x00000293F11EA000-memory.dmp
memory/5772-8-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-28-0x00000293F1240000-0x00000293F1264000-memory.dmp
memory/5772-29-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-24-0x00000293F11F0000-0x00000293F120C000-memory.dmp
memory/5772-31-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-32-0x00007FF48C270000-0x00007FF48C280000-memory.dmp
memory/5772-33-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-34-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-17-0x00007FF48C270000-0x00007FF48C280000-memory.dmp
memory/5772-16-0x00000293F0EC0000-0x00000293F0ED0000-memory.dmp
memory/5772-9-0x00000293F0D40000-0x00000293F0D62000-memory.dmp