Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 15:00
Static task
static1
Behavioral task
behavioral1
Sample
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Resource
win10v20201028
General
-
Target
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
-
Size
90KB
-
MD5
387fd80a5602adc3dd4b2d0197a289de
-
SHA1
b903356e121f997a49759b306533a7ee8880b13b
-
SHA256
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
-
SHA512
3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
Malware Config
Extracted
diamondfox
http://dong7707.at/spt/gate.php
YxgnVQE8PlVLcflLlW4ai9xmX2DERyF4
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule \Users\Admin\AppData\Local\svlspoo\spoolsv.exe diamondfox C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe diamondfox \Users\Admin\AppData\Local\svlspoo\spoolsv.exe diamondfox -
Executes dropped EXE 1 IoCs
Processes:
spoolsv.exepid process 672 spoolsv.exe -
Loads dropped DLL 2 IoCs
Processes:
powershell.exepid process 2032 powershell.exe 2032 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2032 powershell.exe 2032 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2032 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exespoolsv.exepid process 1724 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe 672 spoolsv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exepowershell.exedescription pid process target process PID 1724 wrote to memory of 2032 1724 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 1724 wrote to memory of 2032 1724 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 1724 wrote to memory of 2032 1724 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 1724 wrote to memory of 2032 1724 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 2032 wrote to memory of 672 2032 powershell.exe spoolsv.exe PID 2032 wrote to memory of 672 2032 powershell.exe spoolsv.exe PID 2032 wrote to memory of 672 2032 powershell.exe spoolsv.exe PID 2032 wrote to memory of 672 2032 powershell.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe"C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe' -Destination 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe'2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
387fd80a5602adc3dd4b2d0197a289de
SHA1b903356e121f997a49759b306533a7ee8880b13b
SHA256a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA5123d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
-
\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
387fd80a5602adc3dd4b2d0197a289de
SHA1b903356e121f997a49759b306533a7ee8880b13b
SHA256a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA5123d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
-
\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
387fd80a5602adc3dd4b2d0197a289de
SHA1b903356e121f997a49759b306533a7ee8880b13b
SHA256a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA5123d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
-
memory/672-33-0x0000000000000000-mapping.dmp
-
memory/2032-12-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/2032-21-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/2032-11-0x00000000048C2000-0x00000000048C3000-memory.dmpFilesize
4KB
-
memory/2032-10-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/2032-4-0x0000000000000000-mapping.dmp
-
memory/2032-15-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/2032-20-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/2032-9-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/2032-28-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/2032-29-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/2032-30-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/2032-8-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/2032-7-0x0000000001F10000-0x0000000001F11000-memory.dmpFilesize
4KB
-
memory/2032-6-0x00000000747E0000-0x0000000074ECE000-memory.dmpFilesize
6.9MB
-
memory/2032-5-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB