diamondfox | a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc

Resubmissions

09-04-2024 09:25

04-03-2021 15:00

Target

a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Size

90KB
MD5

387fd80a5602adc3dd4b2d0197a289de
SHA1

b903356e121f997a49759b306533a7ee8880b13b
SHA256

a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA512

3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e

Score

10^/10

Family

diamondfox

http://dong7707.at/spt/gate.php

Mutex

YxgnVQE8PlVLcflLlW4ai9xmX2DERyF4

xor.plain

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 3 IoCs

Detects DiamondFox payload in file/memory.

Executes dropped EXE 1 IoCs

pid	Process
672	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
672	spoolsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2032	1724	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	29
PID 1724 wrote to memory of 2032	1724	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	29
PID 1724 wrote to memory of 2032	1724	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	29
PID 1724 wrote to memory of 2032	1724	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	29
PID 2032 wrote to memory of 672	2032	powershell.exe	31
PID 2032 wrote to memory of 672	2032	powershell.exe	31
PID 2032 wrote to memory of 672	2032	powershell.exe	31
PID 2032 wrote to memory of 672	2032	powershell.exe	31

memory/2032-12-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/2032-21-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/2032-11-0x00000000048C2000-0x00000000048C3000-memory.dmp

Filesize
4KB

Download
memory/2032-10-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/2032-15-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/2032-20-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/2032-9-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2032-28-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/2032-29-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/2032-30-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/2032-8-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/2032-7-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2032-6-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2032-5-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download