diamondfox | f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519

General

Target

DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
Size

573KB
MD5

72bb8e802c14c18dc8822db3b15d6e38
SHA1

ca47292b04a271bc7dbb09cf8bb966eaa478783d
SHA256

f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519
SHA512

f623bdad2e2a259bc4ddc2ba35b7f81c3380e39bcdfdc86506ce22ca717cd223904c30bd48a400319c3e6197bf885fefc1503967b9815e7d734de2d96220332c

Score

10^/10

diamondfox botnet stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral1/memory/596-0-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral1/memory/596-1-0x00000000004011B4-mapping.dmp	diamondfox
behavioral1/memory/596-2-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral1/memory/1656-14-0x00000000004011B4-mapping.dmp	diamondfox

Executes dropped EXE 2 IoCs

pid	Process
1820	atiedxx.exe
1656	atiedxx.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\atiedxx.lnk	powershell.exe

Loads dropped DLL 3 IoCs

pid	Process
304	powershell.exe
304	powershell.exe
1980	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 112 set thread context of 596	112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	24
PID 1820 set thread context of 1656	1820	atiedxx.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
304	powershell.exe
304	powershell.exe
1820	atiedxx.exe
1980	powershell.exe
1980	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
1820	atiedxx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	304	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
596	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
1656	atiedxx.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 596	112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	24
PID 112 wrote to memory of 596	112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	24
PID 112 wrote to memory of 596	112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	24
PID 112 wrote to memory of 596	112	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	24
PID 596 wrote to memory of 304	596	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	25
PID 596 wrote to memory of 304	596	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	25
PID 596 wrote to memory of 304	596	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	25
PID 596 wrote to memory of 304	596	DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr	25
PID 304 wrote to memory of 1820	304	powershell.exe	29
PID 304 wrote to memory of 1820	304	powershell.exe	29
PID 304 wrote to memory of 1820	304	powershell.exe	29
PID 304 wrote to memory of 1820	304	powershell.exe	29
PID 1820 wrote to memory of 1656	1820	atiedxx.exe	30
PID 1820 wrote to memory of 1656	1820	atiedxx.exe	30
PID 1820 wrote to memory of 1656	1820	atiedxx.exe	30
PID 1820 wrote to memory of 1656	1820	atiedxx.exe	30
PID 1656 wrote to memory of 1980	1656	atiedxx.exe	31
PID 1656 wrote to memory of 1980	1656	atiedxx.exe	31
PID 1656 wrote to memory of 1980	1656	atiedxx.exe	31
PID 1656 wrote to memory of 1980	1656	atiedxx.exe	31

C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
"C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:112
- C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr
  "C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件林瑞-1090715-7383-SO.scr" /S
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 ?? TO NEW DELHI SO NO. 7383 CLOSING 07-20 ???????? ??-1090715-7383-SO.scr' -Destination 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe'
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:304
  - - C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe
      "C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe
        
        "C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1656
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $shell = New-Object -ComObject WScript.Shell;$shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\atiedxx.lnk');$shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';$shortcut.Save()
        6⤵
        Drops startup file
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/596-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing