Resubmissions
19-09-2021 03:58
210919-ejryxachcm 1019-09-2021 01:27
210919-bvbjhscgel 1019-09-2021 01:24
210919-bsvvdaaba9 1012-08-2020 13:47
200812-vc8ftkz17s 10Analysis
-
max time kernel
228s -
max time network
224s -
platform
windows10_x64 -
resource
win10-en -
submitted
19-09-2021 01:27
Static task
static1
Behavioral task
behavioral1
Sample
SearchIndexer.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
SearchIndexer.exe
-
Size
91KB
-
MD5
1cc07a0274718e845c9b77f8334c4cb3
-
SHA1
12b6c08371fd4661ed2da442e7ec34f226d7ac01
-
SHA256
b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
-
SHA512
0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
Score
10/10
Malware Config
Extracted
Family
diamondfox
C2
http://timesync.live/panel/gate.php
http://cartierxs.bit/panel/gate.php
http://salamsa.bit/panel/gate.php
http://rockababy.bit/panel/gate.php
http://minon.bit/panel/gate.php
http://bloxfox.bit/panel/gate.php
http://ggbbee.bit/panel/gate.php
http://locksock.bit/panel/gate.php
http://misosoup.bit/panel/gate.php
http://opseckes.bit/panel/gate.php
http://googletabmanager.com/panel/gate.php
Mutex
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
xor.plain
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral1/files/0x000700000001aaf9-144.dat diamondfox behavioral1/files/0x000700000001aaf9-145.dat diamondfox behavioral1/files/0x000700000001aaf9-153.dat diamondfox -
Executes dropped EXE 2 IoCs
pid Process 1640 SearchIndexer.exe 1352 SearchIndexer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3068621934.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3900 powershell.exe 3900 powershell.exe 3900 powershell.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3900 powershell.exe Token: SeDebugPrivilege 580 taskmgr.exe Token: SeSystemProfilePrivilege 580 taskmgr.exe Token: SeCreateGlobalPrivilege 580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3908 SearchIndexer.exe 1640 SearchIndexer.exe 1352 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3908 wrote to memory of 3900 3908 SearchIndexer.exe 70 PID 3908 wrote to memory of 3900 3908 SearchIndexer.exe 70 PID 3908 wrote to memory of 3900 3908 SearchIndexer.exe 70 PID 3900 wrote to memory of 1352 3900 powershell.exe 81 PID 3900 wrote to memory of 1352 3900 powershell.exe 81 PID 3900 wrote to memory of 1352 3900 powershell.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3560
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:580