Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
DMarketBotSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DMarketBotSetup.exe
Resource
win10v2004-20240508-en
General
-
Target
DMarketBotSetup.exe
-
Size
11.1MB
-
MD5
ad3ff4f64452a89434be69825bc2b069
-
SHA1
e03eaba0902079634478a4aa3d97a18f9f75b17b
-
SHA256
6a84fc3e4cb0fa36f73848931304b5b6c37393f6e32aaf04b5e28e87cbe65fef
-
SHA512
d5688b2bfb0d88336f9897c2af6d9615b461c5d2312734c9ecf38acfdf4673925aa9b9a3955b9075e1097d22871705ea4b763b997634d459aea90889490cb642
-
SSDEEP
196608:89t+MxMjM7jxVHWJMt9tRlV4khsV8dVrQVxAZyB1VHfsgZTowF/Aqc:898MxMjM7jrxskCa/OAkUwFY1
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
main.exemain.exepid process 1700 main.exe 676 main.exe -
Loads dropped DLL 9 IoCs
Processes:
main.exepid process 1196 1196 676 main.exe 676 main.exe 676 main.exe 676 main.exe 676 main.exe 676 main.exe 676 main.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 14 IoCs
Processes:
DMarketBotSetup.exedescription ioc process File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.py DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\Uninstall DMarket Bot_lang.ifl DMarketBotSetup.exe File opened for modification C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\Uninstall DMarket Bot_lang.ifl DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\Uninstall DMarket Bot.exe DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\README.md DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\botInfo.txt DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\Uninstall DMarket Bot.dat DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\requirements.txt DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\itemList.txt DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\memoryEraser.py DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\orders.py DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\setupInfo.py DMarketBotSetup.exe File created C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\setupItems.py DMarketBotSetup.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule \Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DMarketBotSetup.exepid process 1504 DMarketBotSetup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 1700 wrote to memory of 676 1700 main.exe main.exe PID 1700 wrote to memory of 676 1700 main.exe main.exe PID 1700 wrote to memory of 676 1700 main.exe main.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DMarketBotSetup.exe"C:\Users\Admin\AppData\Local\Temp\DMarketBotSetup.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe"C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe"C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\Uninstall DMarket Bot_lang.iflFilesize
2KB
MD52922d0c758d9c3c10cbdc59f91979d0c
SHA1feb69bdf58d06cca776db63036811af0764ca013
SHA25620f6d12eac29bd6ddc6a99dd276c5e200fac25c976ab4293195b58ec164c253f
SHA512d15e888bae4e23ce5d61becc3c47d9b5f61fbbe4612cf90677314570fe1df1f4fde6c519b789ad46cc50d19c2b3701bc9bd968e85bb618fb7127950d4ae92695
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\api-ms-win-core-file-l2-1-0.dllFilesize
12KB
MD57f14fd0436c066a8b40e66386ceb55d0
SHA1288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\api-ms-win-core-localization-l1-2-0.dllFilesize
15KB
MD571457fd15de9e0b3ad83b4656cad2870
SHA1c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\api-ms-win-core-processthreads-l1-1-1.dllFilesize
13KB
MD5e93816c04327730d41224e7a1ba6dc51
SHA13f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\api-ms-win-core-timezone-l1-1-0.dllFilesize
13KB
MD5acf40d5e6799231cf7e4026bad0c50a0
SHA18f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA25664b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\python312.dllFilesize
6.7MB
MD5550288a078dffc3430c08da888e70810
SHA101b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA256789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
SHA5127244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\ucrtbase.dllFilesize
994KB
MD58e7680a8d07c3c4159241d31caaf369c
SHA162fe2d4ae788ee3d19e041d81696555a6262f575
SHA25636cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA5129509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
-
\Program Files (x86)\Trade DMarket Bot(Unofficial)\DMarket Bot\main.exeFilesize
9.6MB
MD50c544f637aa8acc1ebf080808bd10d5b
SHA1018c901d31087bbd8c2d726062dcab87cd716f22
SHA256bd63fb5a6dafce33b4421e931fb61f60953ea0db6f05977692cae131b9932b2d
SHA512877a582cd9c2f39e08a6a142d36600107e4129500e963a2a65513137dc5db5f373695bea94b8b6d815fee54ea6fc506e18afd8b45e46cf1b3dd829b7c67519b2
-
\Users\Admin\AppData\Local\Temp\_MEI17002\api-ms-win-core-file-l1-2-0.dllFilesize
12KB
MD549e3260ae3f973608f4d4701eb97eb95
SHA1097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653