Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
368s -
max time network
368s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13/01/2022, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
SearchIndexer.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SearchIndexer.exe
Resource
win10-en-20211208
General
-
Target
SearchIndexer.exe
-
Size
91KB
-
MD5
1cc07a0274718e845c9b77f8334c4cb3
-
SHA1
12b6c08371fd4661ed2da442e7ec34f226d7ac01
-
SHA256
b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
-
SHA512
0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
Malware Config
Extracted
diamondfox
http://timesync.live/panel/gate.php
http://cartierxs.bit/panel/gate.php
http://salamsa.bit/panel/gate.php
http://rockababy.bit/panel/gate.php
http://minon.bit/panel/gate.php
http://bloxfox.bit/panel/gate.php
http://ggbbee.bit/panel/gate.php
http://locksock.bit/panel/gate.php
http://misosoup.bit/panel/gate.php
http://opseckes.bit/panel/gate.php
http://googletabmanager.com/panel/gate.php
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral1/files/0x00070000000138be-61.dat diamondfox behavioral1/files/0x00070000000138be-60.dat diamondfox behavioral1/files/0x00070000000138be-63.dat diamondfox -
Executes dropped EXE 1 IoCs
pid Process 1664 SearchIndexer.exe -
Loads dropped DLL 2 IoCs
pid Process 900 powershell.exe 900 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 900 powershell.exe 900 powershell.exe 900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 788 SearchIndexer.exe 1664 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 788 wrote to memory of 900 788 SearchIndexer.exe 27 PID 788 wrote to memory of 900 788 SearchIndexer.exe 27 PID 788 wrote to memory of 900 788 SearchIndexer.exe 27 PID 788 wrote to memory of 900 788 SearchIndexer.exe 27 PID 900 wrote to memory of 1664 900 powershell.exe 31 PID 900 wrote to memory of 1664 900 powershell.exe 31 PID 900 wrote to memory of 1664 900 powershell.exe 31 PID 900 wrote to memory of 1664 900 powershell.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664
-
-