Overview
overview
7Static
static
3Dark_Queue..._1.rar
windows10-2004-x64
7dark_queue...dex.js
windows10-2004-x64
1dark_queue...add.js
windows10-2004-x64
1dark_queue...VPS.js
windows10-2004-x64
1dark_queue...aim.js
windows10-2004-x64
1dark_queue...ken.js
windows10-2004-x64
1dark_queue...tus.js
windows10-2004-x64
1dark_queue...ime.js
windows10-2004-x64
1dark_queue...key.js
windows10-2004-x64
1dark_queue...ove.js
windows10-2004-x64
1dark_queue...eck.js
windows10-2004-x64
1dark_queue.../qr.js
windows10-2004-x64
1dark_queue...VPS.js
windows10-2004-x64
1dark_queue...aim.js
windows10-2004-x64
1dark_queue...per.js
windows10-2004-x64
1dark_queue...tup.js
windows10-2004-x64
1dark_queue...ats.js
windows10-2004-x64
1dark_queue...eue.js
windows10-2004-x64
1dark_queue...ken.js
windows10-2004-x64
1dark_queue...nce.js
windows10-2004-x64
1dark_queue...ion.js
windows10-2004-x64
1dark_queue...ers.js
windows10-2004-x64
1dark_queue...ers.js
windows10-2004-x64
1dark_queue...nce.js
windows10-2004-x64
1dark_queue...de.png
windows10-2004-x64
3dark_queue...s.json
windows10-2004-x64
3dark_queue...s.json
windows10-2004-x64
3dark_queue...s.json
windows10-2004-x64
3dark_queue...e.json
windows10-2004-x64
3dark_queue...e.json
windows10-2004-x64
3dark_queue...s.json
windows10-2004-x64
3dark_queue...t.json
windows10-2004-x64
3Resubmissions
29/01/2024, 15:16
240129-snmrmsebam 729/01/2024, 15:16
240129-sng66acfb2 729/01/2024, 15:15
240129-sm889acfa8 329/01/2024, 15:11
240129-sk3npaeadm 7Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 15:16
Behavioral task
behavioral1
Sample
Dark_Queuebot_2_1_1_1.rar
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
dark_queuebot/index.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
dark_queuebot/src/commands/admin_home/add.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
dark_queuebot/src/commands/admin_home/addVPS.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
dark_queuebot/src/commands/admin_home/addclaim.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral6
Sample
dark_queuebot/src/commands/admin_home/check-token.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
dark_queuebot/src/commands/admin_home/check-vps-status.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
dark_queuebot/src/commands/admin_home/claim-lifetime.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
dark_queuebot/src/commands/admin_home/generate-key.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
dark_queuebot/src/commands/admin_home/move.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
dark_queuebot/src/commands/admin_home/nitrofoundcheck.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
dark_queuebot/src/commands/admin_home/qr.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
dark_queuebot/src/commands/admin_home/removeVPS.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
dark_queuebot/src/commands/admin_home/removeclaim.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
dark_queuebot/src/commands/admin_home/restart-sniper.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
dark_queuebot/src/commands/admin_home/setup.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
dark_queuebot/src/commands/admin_home/stats.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
dark_queuebot/src/commands/admin_home/update-queue.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
dark_queuebot/src/commands/admin_home/update_main_token.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
dark_queuebot/src/commands/admin_home_new/addbalance.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
dark_queuebot/src/commands/admin_home_new/addpermission.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral22
Sample
dark_queuebot/src/commands/admin_home_new/addusers.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
dark_queuebot/src/commands/admin_home_new/checkservers.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral24
Sample
dark_queuebot/src/commands/admin_home_new/removebalance.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
dark_queuebot/src/data/code.png
Resource
win10v2004-20231215-en
Behavioral task
behavioral26
Sample
dark_queuebot/src/data/credits.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
dark_queuebot/src/data/guilds.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral28
Sample
dark_queuebot/src/data/keys.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
dark_queuebot/src/data/lifetime.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral30
Sample
dark_queuebot/src/data/queue.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
dark_queuebot/src/data/servers.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral32
Sample
dark_queuebot/src/data/stat.json
Resource
win10v2004-20231215-en
General
-
Target
dark_queuebot/src/data/queue.json
-
Size
6B
-
MD5
31eab22238afe4d7f66e291eeecfbb71
-
SHA1
7d19575d56b4df91085839f5a9925753d91d8cb2
-
SHA256
f1632ea82f9437bab32e55ce244ffdcd1f54f563a45c310ffacf82541ac15c0b
-
SHA512
2e7718db2a6b7166604fe2a554dda33fc0fa8ec5a1534809a5f0e0aae94f931f8b42199528f5f59040fb74127f8c707d1389bfd1f5f8e3149b9c333d7556b9a5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2440 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\dark_queuebot\src\data\queue.json1⤵
- Modifies registry class
PID:4372
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2440