Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 15:00
Static task
static1
Behavioral task
behavioral1
Sample
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
Resource
win10v20201028
General
-
Target
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe
-
Size
90KB
-
MD5
387fd80a5602adc3dd4b2d0197a289de
-
SHA1
b903356e121f997a49759b306533a7ee8880b13b
-
SHA256
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
-
SHA512
3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
Malware Config
Extracted
diamondfox
http://dong7707.at/spt/gate.php
YxgnVQE8PlVLcflLlW4ai9xmX2DERyF4
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe diamondfox C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe diamondfox -
Executes dropped EXE 1 IoCs
Processes:
spoolsv.exepid process 3116 spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2844 powershell.exe 2844 powershell.exe 2844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2844 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exespoolsv.exepid process 3928 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe 3116 spoolsv.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exepowershell.exespoolsv.exedescription pid process target process PID 3928 wrote to memory of 2844 3928 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 3928 wrote to memory of 2844 3928 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 3928 wrote to memory of 2844 3928 a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe powershell.exe PID 2844 wrote to memory of 3116 2844 powershell.exe spoolsv.exe PID 2844 wrote to memory of 3116 2844 powershell.exe spoolsv.exe PID 2844 wrote to memory of 3116 2844 powershell.exe spoolsv.exe PID 3116 wrote to memory of 1776 3116 spoolsv.exe powershell.exe PID 3116 wrote to memory of 1776 3116 spoolsv.exe powershell.exe PID 3116 wrote to memory of 1776 3116 spoolsv.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe"C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin.exe' -Destination 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $shell = New-Object -ComObject WScript.Shell;$shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk');$shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';$shortcut.Save()4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
e71a0a7e48b10bde0a9c54387762f33e
SHA1fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA25683d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
387fd80a5602adc3dd4b2d0197a289de
SHA1b903356e121f997a49759b306533a7ee8880b13b
SHA256a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA5123d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
387fd80a5602adc3dd4b2d0197a289de
SHA1b903356e121f997a49759b306533a7ee8880b13b
SHA256a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc
SHA5123d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e
-
memory/1776-30-0x0000000073C20000-0x000000007430E000-memory.dmpFilesize
6.9MB
-
memory/1776-28-0x0000000000000000-mapping.dmp
-
memory/2844-16-0x00000000088B0000-0x00000000088B1000-memory.dmpFilesize
4KB
-
memory/2844-18-0x0000000009550000-0x0000000009551000-memory.dmpFilesize
4KB
-
memory/2844-11-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/2844-12-0x0000000008070000-0x0000000008071000-memory.dmpFilesize
4KB
-
memory/2844-13-0x00000000080E0000-0x00000000080E1000-memory.dmpFilesize
4KB
-
memory/2844-14-0x0000000007400000-0x0000000007401000-memory.dmpFilesize
4KB
-
memory/2844-15-0x0000000008AC0000-0x0000000008AC1000-memory.dmpFilesize
4KB
-
memory/2844-4-0x0000000000000000-mapping.dmp
-
memory/2844-17-0x0000000009870000-0x0000000009871000-memory.dmpFilesize
4KB
-
memory/2844-10-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/2844-19-0x00000000097D0000-0x00000000097D1000-memory.dmpFilesize
4KB
-
memory/2844-20-0x0000000009E60000-0x0000000009E61000-memory.dmpFilesize
4KB
-
memory/2844-21-0x000000000A9E0000-0x000000000A9E1000-memory.dmpFilesize
4KB
-
memory/2844-5-0x0000000073A70000-0x000000007415E000-memory.dmpFilesize
6.9MB
-
memory/2844-8-0x00000000070C0000-0x00000000070C1000-memory.dmpFilesize
4KB
-
memory/2844-9-0x00000000070C2000-0x00000000070C3000-memory.dmpFilesize
4KB
-
memory/2844-27-0x00000000070C3000-0x00000000070C4000-memory.dmpFilesize
4KB
-
memory/2844-7-0x0000000007740000-0x0000000007741000-memory.dmpFilesize
4KB
-
memory/2844-6-0x00000000070D0000-0x00000000070D1000-memory.dmpFilesize
4KB
-
memory/3116-22-0x0000000000000000-mapping.dmp