Analysis
- max time kernel
300s - max time network
202s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 15:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DarkMoon_Gen_1-3.zip
Resource
win7-20240220-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
DarkMoon_Gen_1-3.zip
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
DarkMoon_Gen_1-3/lib/main.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral4
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win7-20240220-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral5
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
300 seconds
Behavioral task
behavioral6
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win7-20240221-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral7
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
30 signatures
300 seconds
General
- Target DarkMoon_Gen_1-3/lib/main.exe
- Size 340KB
- Sample240602-s59bzagg36
- SHA256 c147148fa809e238efc3e60b2ed129a93f11694b31d194f7347ddfbb6b82ba20
- MD5 f3c021dbce0cd670f15415c3aa6b83aa
- SHA1 433842e6529c6df685da1317bfd69d2ea0c85cca
- SHA512 5690f12b45819cf28dfc350d3e362f172f1f589b9614b639f995e1bb56ea8fcb87b3058323998f33dd3637b48f00d596c63866cfde7172a3ac664fac110a6f66
- SSDEEP 3072:eahKyd2n3175Ctbq6rw3VScvNSAh8CndDOMrt1nW:eahOql+UcsMra
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" main.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 16 discord.com - Delays execution with timeout.exe 13 IoCs
pid Process 4876 timeout.exe 4872 timeout.exe 656 timeout.exe 116 timeout.exe 2336 timeout.exe 1696 timeout.exe 4452 timeout.exe 604 timeout.exe 3232 timeout.exe 3896 timeout.exe 1756 timeout.exe 2208 timeout.exe 1936 timeout.exe - Runs ping.exe 1 TTPs 17 IoCs
pid Process 1020 PING.EXE 4248 PING.EXE 3916 PING.EXE 836 PING.EXE 3584 PING.EXE 1448 PING.EXE 1760 PING.EXE 1592 PING.EXE 5112 PING.EXE 4984 PING.EXE 2452 PING.EXE 1432 PING.EXE 116 PING.EXE 2916 PING.EXE 3016 PING.EXE 3060 PING.EXE 3364 PING.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 916 3952 main.exe 82 PID 3952 wrote to memory of 916 3952 main.exe 82 PID 916 wrote to memory of 3808 916 cmd.exe 85 PID 916 wrote to memory of 3808 916 cmd.exe 85 PID 916 wrote to memory of 116 916 cmd.exe 86 PID 916 wrote to memory of 116 916 cmd.exe 86 PID 916 wrote to memory of 1020 916 cmd.exe 89 PID 916 wrote to memory of 1020 916 cmd.exe 89 PID 916 wrote to memory of 2916 916 cmd.exe 90 PID 916 wrote to memory of 2916 916 cmd.exe 90 PID 916 wrote to memory of 4248 916 cmd.exe 91 PID 916 wrote to memory of 4248 916 cmd.exe 91 PID 916 wrote to memory of 1760 916 cmd.exe 92 PID 916 wrote to memory of 1760 916 cmd.exe 92 PID 916 wrote to memory of 3016 916 cmd.exe 93 PID 916 wrote to memory of 3016 916 cmd.exe 93 PID 916 wrote to memory of 3060 916 cmd.exe 94 PID 916 wrote to memory of 3060 916 cmd.exe 94 PID 916 wrote to memory of 836 916 cmd.exe 95 PID 916 wrote to memory of 836 916 cmd.exe 95 PID 916 wrote to memory of 1592 916 cmd.exe 96 PID 916 wrote to memory of 1592 916 cmd.exe 96 PID 916 wrote to memory of 5112 916 cmd.exe 97 PID 916 wrote to memory of 5112 916 cmd.exe 97 PID 916 wrote to memory of 2336 916 cmd.exe 102 PID 916 wrote to memory of 2336 916 cmd.exe 102 PID 916 wrote to memory of 3916 916 cmd.exe 103 PID 916 wrote to memory of 3916 916 cmd.exe 103 PID 916 wrote to memory of 4876 916 cmd.exe 105 PID 916 wrote to memory of 4876 916 cmd.exe 105 PID 916 wrote to memory of 3364 916 cmd.exe 106 PID 916 wrote to memory of 3364 916 cmd.exe 106 PID 916 wrote to memory of 1756 916 cmd.exe 109 PID 916 wrote to memory of 1756 916 cmd.exe 109 PID 916 wrote to memory of 4984 916 cmd.exe 110 PID 916 wrote to memory of 4984 916 cmd.exe 110 PID 916 wrote to memory of 4872 916 cmd.exe 111 PID 916 wrote to memory of 4872 916 cmd.exe 111 PID 916 wrote to memory of 2452 916 cmd.exe 112 PID 916 wrote to memory of 2452 916 cmd.exe 112 PID 916 wrote to memory of 1696 916 cmd.exe 113 PID 916 wrote to memory of 1696 916 cmd.exe 113 PID 916 wrote to memory of 3584 916 cmd.exe 114 PID 916 wrote to memory of 3584 916 cmd.exe 114 PID 916 wrote to memory of 4452 916 cmd.exe 118 PID 916 wrote to memory of 4452 916 cmd.exe 118 PID 916 wrote to memory of 1432 916 cmd.exe 119 PID 916 wrote to memory of 1432 916 cmd.exe 119 PID 916 wrote to memory of 2208 916 cmd.exe 120 PID 916 wrote to memory of 2208 916 cmd.exe 120 PID 916 wrote to memory of 1448 916 cmd.exe 121 PID 916 wrote to memory of 1448 916 cmd.exe 121 PID 916 wrote to memory of 604 916 cmd.exe 122 PID 916 wrote to memory of 604 916 cmd.exe 122 PID 916 wrote to memory of 656 916 cmd.exe 123 PID 916 wrote to memory of 656 916 cmd.exe 123 PID 916 wrote to memory of 3232 916 cmd.exe 124 PID 916 wrote to memory of 3232 916 cmd.exe 124 PID 916 wrote to memory of 3896 916 cmd.exe 125 PID 916 wrote to memory of 3896 916 cmd.exe 125 PID 916 wrote to memory of 116 916 cmd.exe 126 PID 916 wrote to memory of 116 916 cmd.exe 126 PID 916 wrote to memory of 1936 916 cmd.exe 127 PID 916 wrote to memory of 1936 916 cmd.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe"C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SYSTEM32\cmd.execmd /c "Dark Moon gen.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3808
-
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:116
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:1020
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:2916
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:4248
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:1760
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:3016
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:3060
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:836
-
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
PID:1592
-
-
C:\Windows\system32\PING.EXEping discord.com3⤵
- Runs ping.exe
PID:5112
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:2336
-
-
C:\Windows\system32\PING.EXEping www.paysafecard.com3⤵
- Runs ping.exe
PID:3916
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:4876
-
-
C:\Windows\system32\PING.EXEping www.amazon.com3⤵
- Runs ping.exe
PID:3364
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:1756
-
-
C:\Windows\system32\PING.EXEping play.google.com3⤵
- Runs ping.exe
PID:4984
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:4872
-
-
C:\Windows\system32\PING.EXEping store.steampowered.com3⤵
- Runs ping.exe
PID:2452
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:1696
-
-
C:\Windows\system32\PING.EXEping netflix.com3⤵
- Runs ping.exe
PID:3584
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:4452
-
-
C:\Windows\system32\PING.EXEping www.spotify.com3⤵
- Runs ping.exe
PID:1432
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:2208
-
-
C:\Windows\system32\PING.EXEping www.xbox.com3⤵
- Runs ping.exe
PID:1448
-
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
PID:604
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:656
-
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:3232
-
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:3896
-
-
C:\Windows\system32\PING.EXEping www.google.com3⤵
- Runs ping.exe
PID:116
-
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:1936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.bat
- Size 35KB
- SHA256 2fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
- MD5 c153581143e0b72cecae38a393991a4b
- SHA1 da43d03b19765594ff124415a060551343823a39
- SHA512 8c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
- SSDEEP 768:sQFlE38u/LOzTWyv+C42E42aSCghIcjH3oyjoyhPekLLokLL76VkLLHwkLDkLP9J:sQFl48GLOzTWyv+C42E42aSCghIcjH3e
- MD5 SHA1 SHA512 SSDEEP