Analysis
-
max time kernel
300s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
DarkMoon_Gen_1-3.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
DarkMoon_Gen_1-3.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
DarkMoon_Gen_1-3/lib/main.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win10v2004-20240226-en
General
-
Target
DarkMoon_Gen_1-3/lib/main.exe
-
Size
340KB
-
MD5
f3c021dbce0cd670f15415c3aa6b83aa
-
SHA1
433842e6529c6df685da1317bfd69d2ea0c85cca
-
SHA256
c147148fa809e238efc3e60b2ed129a93f11694b31d194f7347ddfbb6b82ba20
-
SHA512
5690f12b45819cf28dfc350d3e362f172f1f589b9614b639f995e1bb56ea8fcb87b3058323998f33dd3637b48f00d596c63866cfde7172a3ac664fac110a6f66
-
SSDEEP
3072:eahKyd2n3175Ctbq6rw3VScvNSAh8CndDOMrt1nW:eahOql+UcsMra
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
main.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" main.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Delays execution with timeout.exe 13 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4876 timeout.exe 4872 timeout.exe 656 timeout.exe 116 timeout.exe 2336 timeout.exe 1696 timeout.exe 4452 timeout.exe 604 timeout.exe 3232 timeout.exe 3896 timeout.exe 1756 timeout.exe 2208 timeout.exe 1936 timeout.exe -
Runs ping.exe 1 TTPs 17 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1020 PING.EXE 4248 PING.EXE 3916 PING.EXE 836 PING.EXE 3584 PING.EXE 1448 PING.EXE 1760 PING.EXE 1592 PING.EXE 5112 PING.EXE 4984 PING.EXE 2452 PING.EXE 1432 PING.EXE 116 PING.EXE 2916 PING.EXE 3016 PING.EXE 3060 PING.EXE 3364 PING.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
main.execmd.exedescription pid process target process PID 3952 wrote to memory of 916 3952 main.exe cmd.exe PID 3952 wrote to memory of 916 3952 main.exe cmd.exe PID 916 wrote to memory of 3808 916 cmd.exe chcp.com PID 916 wrote to memory of 3808 916 cmd.exe chcp.com PID 916 wrote to memory of 116 916 cmd.exe timeout.exe PID 916 wrote to memory of 116 916 cmd.exe timeout.exe PID 916 wrote to memory of 1020 916 cmd.exe PING.EXE PID 916 wrote to memory of 1020 916 cmd.exe PING.EXE PID 916 wrote to memory of 2916 916 cmd.exe PING.EXE PID 916 wrote to memory of 2916 916 cmd.exe PING.EXE PID 916 wrote to memory of 4248 916 cmd.exe PING.EXE PID 916 wrote to memory of 4248 916 cmd.exe PING.EXE PID 916 wrote to memory of 1760 916 cmd.exe PING.EXE PID 916 wrote to memory of 1760 916 cmd.exe PING.EXE PID 916 wrote to memory of 3016 916 cmd.exe PING.EXE PID 916 wrote to memory of 3016 916 cmd.exe PING.EXE PID 916 wrote to memory of 3060 916 cmd.exe PING.EXE PID 916 wrote to memory of 3060 916 cmd.exe PING.EXE PID 916 wrote to memory of 836 916 cmd.exe PING.EXE PID 916 wrote to memory of 836 916 cmd.exe PING.EXE PID 916 wrote to memory of 1592 916 cmd.exe PING.EXE PID 916 wrote to memory of 1592 916 cmd.exe PING.EXE PID 916 wrote to memory of 5112 916 cmd.exe PING.EXE PID 916 wrote to memory of 5112 916 cmd.exe PING.EXE PID 916 wrote to memory of 2336 916 cmd.exe timeout.exe PID 916 wrote to memory of 2336 916 cmd.exe timeout.exe PID 916 wrote to memory of 3916 916 cmd.exe PING.EXE PID 916 wrote to memory of 3916 916 cmd.exe PING.EXE PID 916 wrote to memory of 4876 916 cmd.exe timeout.exe PID 916 wrote to memory of 4876 916 cmd.exe timeout.exe PID 916 wrote to memory of 3364 916 cmd.exe PING.EXE PID 916 wrote to memory of 3364 916 cmd.exe PING.EXE PID 916 wrote to memory of 1756 916 cmd.exe timeout.exe PID 916 wrote to memory of 1756 916 cmd.exe timeout.exe PID 916 wrote to memory of 4984 916 cmd.exe PING.EXE PID 916 wrote to memory of 4984 916 cmd.exe PING.EXE PID 916 wrote to memory of 4872 916 cmd.exe timeout.exe PID 916 wrote to memory of 4872 916 cmd.exe timeout.exe PID 916 wrote to memory of 2452 916 cmd.exe PING.EXE PID 916 wrote to memory of 2452 916 cmd.exe PING.EXE PID 916 wrote to memory of 1696 916 cmd.exe timeout.exe PID 916 wrote to memory of 1696 916 cmd.exe timeout.exe PID 916 wrote to memory of 3584 916 cmd.exe PING.EXE PID 916 wrote to memory of 3584 916 cmd.exe PING.EXE PID 916 wrote to memory of 4452 916 cmd.exe timeout.exe PID 916 wrote to memory of 4452 916 cmd.exe timeout.exe PID 916 wrote to memory of 1432 916 cmd.exe PING.EXE PID 916 wrote to memory of 1432 916 cmd.exe PING.EXE PID 916 wrote to memory of 2208 916 cmd.exe timeout.exe PID 916 wrote to memory of 2208 916 cmd.exe timeout.exe PID 916 wrote to memory of 1448 916 cmd.exe PING.EXE PID 916 wrote to memory of 1448 916 cmd.exe PING.EXE PID 916 wrote to memory of 604 916 cmd.exe timeout.exe PID 916 wrote to memory of 604 916 cmd.exe timeout.exe PID 916 wrote to memory of 656 916 cmd.exe timeout.exe PID 916 wrote to memory of 656 916 cmd.exe timeout.exe PID 916 wrote to memory of 3232 916 cmd.exe timeout.exe PID 916 wrote to memory of 3232 916 cmd.exe timeout.exe PID 916 wrote to memory of 3896 916 cmd.exe timeout.exe PID 916 wrote to memory of 3896 916 cmd.exe timeout.exe PID 916 wrote to memory of 116 916 cmd.exe PING.EXE PID 916 wrote to memory of 116 916 cmd.exe PING.EXE PID 916 wrote to memory of 1936 916 cmd.exe timeout.exe PID 916 wrote to memory of 1936 916 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe"C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "Dark Moon gen.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 13⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping discord.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.paysafecard.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.amazon.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping play.google.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping store.steampowered.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping netflix.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.spotify.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.xbox.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 03⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.google.com3⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.batFilesize
35KB
MD5c153581143e0b72cecae38a393991a4b
SHA1da43d03b19765594ff124415a060551343823a39
SHA2562fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
SHA5128c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f