Overview

overview

10

Static

static

10

SearchIndexer.exe

windows10_x64

10

Resubmissions

19-09-2021 03:58

210919-ejryxachcm 10

19-09-2021 01:27

210919-bvbjhscgel 10

19-09-2021 01:24

210919-bsvvdaaba9 10

12-08-2020 13:47

200812-vc8ftkz17s 10

Analysis

  • max time kernel
    228s
  • max time network
    224s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    19-09-2021 01:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SearchIndexer.exe

  • Size

    91KB

  • MD5

    1cc07a0274718e845c9b77f8334c4cb3

  • SHA1

    12b6c08371fd4661ed2da442e7ec34f226d7ac01

  • SHA256

    b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

  • SHA512

    0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

Score
10/10
diamondfoxbotnetstealer

Malware Config

Extracted

Family

diamondfox

C2

http://timesync.live/panel/gate.php

http://cartierxs.bit/panel/gate.php

http://salamsa.bit/panel/gate.php

http://rockababy.bit/panel/gate.php

http://minon.bit/panel/gate.php

http://bloxfox.bit/panel/gate.php

http://ggbbee.bit/panel/gate.php

http://locksock.bit/panel/gate.php

http://misosoup.bit/panel/gate.php

http://opseckes.bit/panel/gate.php

http://googletabmanager.com/panel/gate.php
Mutex

cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS

xor.plain

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 3 IoCs

    Detects DiamondFox payload in file/memory.

  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3908
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
        "C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1352
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3560
    • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
      "C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1640
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:580

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
      MD5

      1cc07a0274718e845c9b77f8334c4cb3

      SHA1

      12b6c08371fd4661ed2da442e7ec34f226d7ac01

      SHA256

      b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

      SHA512

      0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

      Download Submit
    • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
      MD5

      1cc07a0274718e845c9b77f8334c4cb3

      SHA1

      12b6c08371fd4661ed2da442e7ec34f226d7ac01

      SHA256

      b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

      SHA512

      0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

      Download Submit
    • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
      MD5

      1cc07a0274718e845c9b77f8334c4cb3

      SHA1

      12b6c08371fd4661ed2da442e7ec34f226d7ac01

      SHA256

      b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

      SHA512

      0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

      Download Submit
    • memory/1352-152-0x0000000000000000-mapping.dmp
      Download
    • memory/3900-129-0x0000000008550000-0x0000000008551000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-136-0x00000000094D0000-0x00000000094D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-125-0x0000000004DD2000-0x0000000004DD3000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-126-0x00000000080A0000-0x00000000080A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-127-0x0000000008110000-0x0000000008111000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-128-0x0000000007F40000-0x0000000007F41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-117-0x0000000000000000-mapping.dmp
      Download
    • memory/3900-130-0x0000000008870000-0x0000000008871000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-135-0x0000000009620000-0x0000000009621000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-124-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-137-0x0000000009550000-0x0000000009551000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-138-0x0000000009E00000-0x0000000009E01000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-143-0x000000000A980000-0x000000000A981000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-123-0x0000000007E50000-0x0000000007E51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-122-0x00000000076B0000-0x00000000076B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-121-0x00000000077B0000-0x00000000077B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-120-0x0000000004D20000-0x0000000004D21000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3900-157-0x0000000004DD3000-0x0000000004DD4000-memory.dmp
      Filesize

      4KB

      Download