Overview

overview

10

Static

static

DRAFT HBL ...SO.scr

windows7_x64

10

DRAFT HBL ...SO.scr

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    16/07/2020, 06:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr
  • Size 573KB
  • Sample200716-fsa1t7nb5j
  • SHA256 f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519
  • MD5 SHA1 SHA512
Score
10/10
diamondfoxbotnetstealer

Malware Config

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 2 IoCs

    Detects DiamondFox payload in file/memory.

  • ServiceHost packer 6 IoCs

    Detects ServiceHost packer used for .NET malware

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr
    "C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr
      "C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr" /S
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\DRAFT HBL 2007106 ?? TO NEW DELHI SO NO. 7383 CLOSING 07-20 ???????? ??-1090715-7383-SO.scr' -Destination 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe'
        3⤵
          PID:1184
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 704
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2644

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/2644-6-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
          Download

          memory/2644-13-0x00000000051F0000-0x00000000051F1000-memory.dmp
          Download

          memory/3236-0-0x0000000000400000-0x000000000041A000-memory.dmp
          Download