lunar[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lunar.exe
Size 884KB
Sample261113-asm9vsys7k
SHA256 dcf538d0f9429b64524162769251c88443ae9f2acdf035278084f837fd01f794
MD5 02e34355913f30152c3efc71b333dbd3
SHA1 5c18b4df2b643c9988f0893fd89ba0d70f9aa0aa
SHA512 756328574ca6243f74f30c286d144250df04def7d7c406e7c3f84febafc984f8d3e3b1f671098c5bb553b2f89319b09719083f9cf51a80929ce563ea3226613f
SSDEEP 12288:F7yyCq/faYr5ZIo/DURdQbxh1APTK3lFbSjx6DXWVIQouXb:Yyh/PZ/LhKcQouXb
TLSH
T14A154A83A6DB0CEAD9936B7850EB633AA735FD708B7A4B274518C2314D136D06D2FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lunar.exe

File Explorer

lunar.exe

.exe 884KB

lunar.exe

IMPHASH 51dfbc68c8d8e8083858da5c107a9f96
SHA256 dcf538d0f9429b64524162769251c88443ae9f2acdf035278084f837fd01f794
MD5 02e34355913f30152c3efc71b333dbd3
SHA1 5c18b4df2b643c9988f0893fd89ba0d70f9aa0aa
SHA512 756328574ca6243f74f30c286d144250df04def7d7c406e7c3f84febafc984f8d3e3b1f671098c5bb553b2f89319b09719083f9cf51a80929ce563ea3226613f
SSDEEP 12288:F7yyCq/faYr5ZIo/DURdQbxh1APTK3lFbSjx6DXWVIQouXb:Yyh/PZ/LhKcQouXb
TLSH
T14A154A83A6DB0CEAD9936B7850EB633AA735FD708B7A4B274518C2314D136D06D2FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject LineTo MoveToEx RoundRect SelectObject SetBkMode SetTextColor

iphlpapi

GetAdaptersAddresses

kernel32

CloseHandle CreateFileW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitThread ExpandEnvironmentStringsW FormatMessageA GetComputerNameW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeThread GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount GetTimeZoneInformation GetWindowsDirectoryW InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar RaiseException ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFirmwareEnvironmentVariableW SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno fwprintf _fmode _initterm _ismbblead _onexit _time64 _wcsicmp abort calloc exit fprintf fputc fputs fputwc free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc signal strchr strcmp strerror strlen strncmp strncpy strtoul system towupper vfprintf wcslen _read

shell32

ShellExecuteExW

user32

BeginPaint CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetCursorPos GetMessageW GetSystemMetrics InvalidateRect LoadCursorW LoadIconW PostMessageW PostQuitMessage RegisterClassExW ScreenToClient SetTimer ShowWindow TrackMouseEvent TranslateMessage UpdateWindow

ws2_32

WSACleanup WSAStartup

Name

.text

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lunar.exe

advapi32

comctl32

dwmapi

gdi32

iphlpapi

kernel32

msvcrt

shell32

user32

ws2_32

generic