Analysis
- max time kernel
131s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/01/2022, 22:42
General
- Target SearchIndexer.exe
- Size 91KB
- Sample220113-2m6b2achg5
- SHA256 b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
Malware Config
Extracted
-
diamondfox
-
http://timesync.live/panel/gate.php
-
http://cartierxs.bit/panel/gate.php
-
http://salamsa.bit/panel/gate.php
-
http://rockababy.bit/panel/gate.php
-
http://minon.bit/panel/gate.php
-
http://bloxfox.bit/panel/gate.php
-
http://ggbbee.bit/panel/gate.php
-
http://locksock.bit/panel/gate.php
-
http://misosoup.bit/panel/gate.php
-
http://opseckes.bit/panel/gate.php
-
http://googletabmanager.com/panel/gate.php
-
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
Signatures
- DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
- DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/912-115-0x0000000000690000-0x0000000000696000-memory.dmp
memory/912-116-0x0000000000690000-0x000000000069A000-memory.dmp
memory/2280-127-0x0000000007B70000-0x0000000007EC0000-memory.dmp
memory/2280-131-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/2280-122-0x0000000002E72000-0x0000000002E73000-memory.dmp
memory/2280-123-0x0000000007160000-0x0000000007788000-memory.dmp
memory/2280-124-0x0000000007880000-0x00000000078A2000-memory.dmp
memory/2280-125-0x0000000007B00000-0x0000000007B66000-memory.dmp
memory/2280-126-0x0000000007920000-0x0000000007986000-memory.dmp
memory/2280-120-0x0000000004750000-0x0000000004786000-memory.dmp
memory/2280-128-0x0000000006DC0000-0x0000000006DDC000-memory.dmp
memory/2280-129-0x0000000008080000-0x00000000080CB000-memory.dmp
memory/2280-130-0x00000000082B0000-0x0000000008326000-memory.dmp
memory/2280-121-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/2280-137-0x00000000091B0000-0x0000000009244000-memory.dmp
memory/2280-138-0x00000000090B0000-0x00000000090CA000-memory.dmp
memory/2280-139-0x0000000009140000-0x0000000009162000-memory.dmp
memory/2280-140-0x00000000097D0000-0x0000000009CCE000-memory.dmp
memory/2280-145-0x000000000A350000-0x000000000A9C8000-memory.dmp
memory/2280-118-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/2280-119-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/2280-155-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/2280-156-0x0000000002E73000-0x0000000002E74000-memory.dmp