Resubmissions
19-09-2021 03:58
210919-ejryxachcm 1019-09-2021 01:27
210919-bvbjhscgel 1019-09-2021 01:24
210919-bsvvdaaba9 1012-08-2020 13:47
200812-vc8ftkz17s 10Analysis
-
max time kernel
241s -
max time network
243s -
platform
windows10_x64 -
resource
win10-en -
submitted
19-09-2021 03:58
Static task
static1
Behavioral task
behavioral1
Sample
SearchIndexer.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
SearchIndexer.exe
-
Size
91KB
-
MD5
1cc07a0274718e845c9b77f8334c4cb3
-
SHA1
12b6c08371fd4661ed2da442e7ec34f226d7ac01
-
SHA256
b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
-
SHA512
0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
Score
10/10
Malware Config
Extracted
Family
diamondfox
C2
http://timesync.live/panel/gate.php
http://cartierxs.bit/panel/gate.php
http://salamsa.bit/panel/gate.php
http://rockababy.bit/panel/gate.php
http://minon.bit/panel/gate.php
http://bloxfox.bit/panel/gate.php
http://ggbbee.bit/panel/gate.php
http://locksock.bit/panel/gate.php
http://misosoup.bit/panel/gate.php
http://opseckes.bit/panel/gate.php
http://googletabmanager.com/panel/gate.php
Mutex
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
xor.plain
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral1/files/0x000400000001aae5-150.dat diamondfox behavioral1/files/0x000400000001aae5-149.dat diamondfox -
Executes dropped EXE 1 IoCs
pid Process 4444 SearchIndexer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3068621934.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4792 powershell.exe 4792 powershell.exe 4792 powershell.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4792 powershell.exe Token: SeDebugPrivilege 4620 taskmgr.exe Token: SeSystemProfilePrivilege 4620 taskmgr.exe Token: SeCreateGlobalPrivilege 4620 taskmgr.exe Token: 33 4620 taskmgr.exe Token: SeIncBasePriorityPrivilege 4620 taskmgr.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe 4620 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4688 SearchIndexer.exe 4444 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4688 wrote to memory of 4792 4688 SearchIndexer.exe 70 PID 4688 wrote to memory of 4792 4688 SearchIndexer.exe 70 PID 4688 wrote to memory of 4792 4688 SearchIndexer.exe 70 PID 4792 wrote to memory of 4444 4792 powershell.exe 80 PID 4792 wrote to memory of 4444 4792 powershell.exe 80 PID 4792 wrote to memory of 4444 4792 powershell.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4100
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4620