diamondfox | a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc

General

Target

a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Size

90KB
MD5

387fd80a5602adc3dd4b2d0197a289de
SHA1

b903356e121f997a49759b306533a7ee8880b13b
SHA256

a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA512

3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e

Score

10^/10

diamondfox botnet stealer

Malware Config

Extracted

Family

diamondfox

C2

http://dong7707.at/spt/gate.php

Mutex

YxgnVQE8PlVLcflLlW4ai9xmX2DERyF4

xor.plain

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 2 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral2/files/0x000500000001a4f4-24.dat	diamondfox
behavioral2/files/0x000500000001a4f4-23.dat	diamondfox

Executes dropped EXE 1 IoCs

pid	Process
3116	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2844	powershell.exe
2844	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3928	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
3116	spoolsv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2844	3928	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	78
PID 3928 wrote to memory of 2844	3928	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	78
PID 3928 wrote to memory of 2844	3928	a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe	78
PID 2844 wrote to memory of 3116	2844	powershell.exe	80
PID 2844 wrote to memory of 3116	2844	powershell.exe	80
PID 2844 wrote to memory of 3116	2844	powershell.exe	80
PID 3116 wrote to memory of 1776	3116	spoolsv.exe	81
PID 3116 wrote to memory of 1776	3116	spoolsv.exe	81
PID 3116 wrote to memory of 1776	3116	spoolsv.exe	81

C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
"C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe' -Destination 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe
    "C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $shell = New-Object -ComObject WScript.Shell;$shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk');$shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';$shortcut.Save()
      4⤵
      PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-30-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/2844-16-0x00000000088B0000-0x00000000088B1000-memory.dmp

Filesize
4KB

Download
memory/2844-18-0x0000000009550000-0x0000000009551000-memory.dmp

Filesize
4KB

Download
memory/2844-11-0x0000000007E90000-0x0000000007E91000-memory.dmp

Filesize
4KB

Download
memory/2844-12-0x0000000008070000-0x0000000008071000-memory.dmp

Filesize
4KB

Download
memory/2844-13-0x00000000080E0000-0x00000000080E1000-memory.dmp

Filesize
4KB

Download
memory/2844-14-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/2844-15-0x0000000008AC0000-0x0000000008AC1000-memory.dmp

Filesize
4KB

Download
memory/2844-17-0x0000000009870000-0x0000000009871000-memory.dmp

Filesize
4KB

Download
memory/2844-10-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

Filesize
4KB

Download
memory/2844-19-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2844-20-0x0000000009E60000-0x0000000009E61000-memory.dmp

Filesize
4KB

Download
memory/2844-21-0x000000000A9E0000-0x000000000A9E1000-memory.dmp

Filesize
4KB

Download
memory/2844-5-0x0000000073A70000-0x000000007415E000-memory.dmp

Filesize
6.9MB

Download
memory/2844-8-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/2844-9-0x00000000070C2000-0x00000000070C3000-memory.dmp

Filesize
4KB

Download
memory/2844-27-0x00000000070C3000-0x00000000070C4000-memory.dmp

Filesize
4KB

Download
memory/2844-7-0x0000000007740000-0x0000000007741000-memory.dmp

Filesize
4KB

Download
memory/2844-6-0x00000000070D0000-0x00000000070D1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing