Analysis
- max time kernel
125s - max time network
128s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/01/2022, 22:52
General
- Target SearchIndexer.exe
- Size 91KB
- Sample220113-2tr3zsdahr
- SHA256 b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
Malware Config
Extracted
-
diamondfox
-
http://timesync.live/panel/gate.php
-
http://cartierxs.bit/panel/gate.php
-
http://salamsa.bit/panel/gate.php
-
http://rockababy.bit/panel/gate.php
-
http://minon.bit/panel/gate.php
-
http://bloxfox.bit/panel/gate.php
-
http://ggbbee.bit/panel/gate.php
-
http://locksock.bit/panel/gate.php
-
http://misosoup.bit/panel/gate.php
-
http://opseckes.bit/panel/gate.php
-
http://googletabmanager.com/panel/gate.php
-
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
Signatures
- DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
- DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1308-127-0x00000000083B0000-0x0000000008700000-memory.dmp
memory/1308-145-0x000000000AC00000-0x000000000B278000-memory.dmp
memory/1308-119-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1308-120-0x0000000007220000-0x0000000007256000-memory.dmp
memory/1308-121-0x0000000007330000-0x0000000007331000-memory.dmp
memory/1308-122-0x0000000007332000-0x0000000007333000-memory.dmp
memory/1308-123-0x0000000007970000-0x0000000007F98000-memory.dmp
memory/1308-124-0x0000000007810000-0x0000000007832000-memory.dmp
memory/1308-125-0x0000000008010000-0x0000000008076000-memory.dmp
memory/1308-126-0x0000000008080000-0x00000000080E6000-memory.dmp
memory/1308-156-0x0000000007333000-0x0000000007334000-memory.dmp
memory/1308-128-0x0000000008110000-0x000000000812C000-memory.dmp
memory/1308-118-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1308-155-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1308-129-0x0000000008700000-0x000000000874B000-memory.dmp
memory/1308-137-0x0000000009AC0000-0x0000000009B54000-memory.dmp
memory/1308-138-0x0000000009770000-0x000000000978A000-memory.dmp
memory/1308-139-0x00000000097D0000-0x00000000097F2000-memory.dmp
memory/1308-140-0x000000000A080000-0x000000000A57E000-memory.dmp
memory/1308-131-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1308-130-0x0000000008960000-0x00000000089D6000-memory.dmp
memory/2724-116-0x0000000000690000-0x000000000069A000-memory.dmp
memory/2724-115-0x0000000000690000-0x0000000000696000-memory.dmp