diamondfox | f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519

General

Target

f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
Size

573KB
MD5

72bb8e802c14c18dc8822db3b15d6e38
SHA1

ca47292b04a271bc7dbb09cf8bb966eaa478783d
SHA256

f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519
SHA512

f623bdad2e2a259bc4ddc2ba35b7f81c3380e39bcdfdc86506ce22ca717cd223904c30bd48a400319c3e6197bf885fefc1503967b9815e7d734de2d96220332c

Score

10^/10

diamondfox botnet stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral1/memory/1468-0-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral1/memory/1468-1-0x00000000004011B4-mapping.dmp	diamondfox
behavioral1/memory/1468-2-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral1/memory/1588-14-0x00000000004011B4-mapping.dmp	diamondfox

Executes dropped EXE 2 IoCs

pid	Process
1624	atiedxx.exe
1588	atiedxx.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\atiedxx.lnk	powershell.exe

Loads dropped DLL 3 IoCs

pid	Process
992	powershell.exe
992	powershell.exe
2000	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 1468	1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	24
PID 1624 set thread context of 1588	1624	atiedxx.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
992	powershell.exe
992	powershell.exe
1624	atiedxx.exe
2000	powershell.exe
2000	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
1624	atiedxx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
1588	atiedxx.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1468	1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	24
PID 1412 wrote to memory of 1468	1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	24
PID 1412 wrote to memory of 1468	1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	24
PID 1412 wrote to memory of 1468	1412	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	24
PID 1468 wrote to memory of 992	1468	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	25
PID 1468 wrote to memory of 992	1468	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	25
PID 1468 wrote to memory of 992	1468	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	25
PID 1468 wrote to memory of 992	1468	f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe	25
PID 992 wrote to memory of 1624	992	powershell.exe	29
PID 992 wrote to memory of 1624	992	powershell.exe	29
PID 992 wrote to memory of 1624	992	powershell.exe	29
PID 992 wrote to memory of 1624	992	powershell.exe	29
PID 1624 wrote to memory of 1588	1624	atiedxx.exe	30
PID 1624 wrote to memory of 1588	1624	atiedxx.exe	30
PID 1624 wrote to memory of 1588	1624	atiedxx.exe	30
PID 1624 wrote to memory of 1588	1624	atiedxx.exe	30
PID 1588 wrote to memory of 2000	1588	atiedxx.exe	31
PID 1588 wrote to memory of 2000	1588	atiedxx.exe	31
PID 1588 wrote to memory of 2000	1588	atiedxx.exe	31
PID 1588 wrote to memory of 2000	1588	atiedxx.exe	31

C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
"C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
  "C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe' -Destination 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe'
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe
      "C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe
        
        "C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1588
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $shell = New-Object -ComObject WScript.Shell;$shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\atiedxx.lnk');$shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';$shortcut.Save()
        6⤵
        Drops startup file
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1468-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing