Overview

overview

10

Static

static

f771b27722...19.exe

windows7_x64

10

f771b27722...19.exe

windows10_x64

10

Analysis

  • max time kernel
    65s
  • max time network
    93s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    16-07-2020 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe

  • Size

    573KB

  • MD5

    72bb8e802c14c18dc8822db3b15d6e38

  • SHA1

    ca47292b04a271bc7dbb09cf8bb966eaa478783d

  • SHA256

    f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519

  • SHA512

    f623bdad2e2a259bc4ddc2ba35b7f81c3380e39bcdfdc86506ce22ca717cd223904c30bd48a400319c3e6197bf885fefc1503967b9815e7d734de2d96220332c

Score
10/10
diamondfoxbotnetstealer

Malware Config

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 2 IoCs

    Detects DiamondFox payload in file/memory.

  • ServiceHost packer 6 IoCs

    Detects ServiceHost packer used for .NET malware

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
    "C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe
      "C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe' -Destination 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xxdatie\atiedxx.exe'
        3⤵
          PID:3844
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 704
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3740

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3720-0-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/3720-1-0x00000000004011B4-mapping.dmp
      Download
    • memory/3740-6-0x0000000004470000-0x0000000004471000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3740-13-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3844-5-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-7-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-8-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-9-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-10-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-11-0x0000000000000000-mapping.dmp
      Download
    • memory/3844-12-0x0000000000000000-mapping.dmp
      Download