Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13/01/2022, 22:52

General

  • Target

    SearchIndexer.exe

  • Size

    91KB

  • MD5

    1cc07a0274718e845c9b77f8334c4cb3

  • SHA1

    12b6c08371fd4661ed2da442e7ec34f226d7ac01

  • SHA256

    b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

  • SHA512

    0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

Malware Config

Extracted

Family

diamondfox

C2

http://timesync.live/panel/gate.php

http://cartierxs.bit/panel/gate.php

http://salamsa.bit/panel/gate.php

http://rockababy.bit/panel/gate.php

http://minon.bit/panel/gate.php

http://bloxfox.bit/panel/gate.php

http://ggbbee.bit/panel/gate.php

http://locksock.bit/panel/gate.php

http://misosoup.bit/panel/gate.php

http://opseckes.bit/panel/gate.php

http://googletabmanager.com/panel/gate.php

Mutex

cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS

xor.plain

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

  • DiamondFox payload 2 IoCs

    Detects DiamondFox payload in file/memory.

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
        "C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1308-127-0x00000000083B0000-0x0000000008700000-memory.dmp

    Filesize

    3.3MB

  • memory/1308-145-0x000000000AC00000-0x000000000B278000-memory.dmp

    Filesize

    6.5MB

  • memory/1308-119-0x0000000004D70000-0x0000000004D71000-memory.dmp

    Filesize

    4KB

  • memory/1308-120-0x0000000007220000-0x0000000007256000-memory.dmp

    Filesize

    216KB

  • memory/1308-121-0x0000000007330000-0x0000000007331000-memory.dmp

    Filesize

    4KB

  • memory/1308-122-0x0000000007332000-0x0000000007333000-memory.dmp

    Filesize

    4KB

  • memory/1308-123-0x0000000007970000-0x0000000007F98000-memory.dmp

    Filesize

    6.2MB

  • memory/1308-124-0x0000000007810000-0x0000000007832000-memory.dmp

    Filesize

    136KB

  • memory/1308-125-0x0000000008010000-0x0000000008076000-memory.dmp

    Filesize

    408KB

  • memory/1308-126-0x0000000008080000-0x00000000080E6000-memory.dmp

    Filesize

    408KB

  • memory/1308-156-0x0000000007333000-0x0000000007334000-memory.dmp

    Filesize

    4KB

  • memory/1308-128-0x0000000008110000-0x000000000812C000-memory.dmp

    Filesize

    112KB

  • memory/1308-118-0x0000000004D70000-0x0000000004D71000-memory.dmp

    Filesize

    4KB

  • memory/1308-155-0x0000000004D70000-0x0000000004D71000-memory.dmp

    Filesize

    4KB

  • memory/1308-129-0x0000000008700000-0x000000000874B000-memory.dmp

    Filesize

    300KB

  • memory/1308-137-0x0000000009AC0000-0x0000000009B54000-memory.dmp

    Filesize

    592KB

  • memory/1308-138-0x0000000009770000-0x000000000978A000-memory.dmp

    Filesize

    104KB

  • memory/1308-139-0x00000000097D0000-0x00000000097F2000-memory.dmp

    Filesize

    136KB

  • memory/1308-140-0x000000000A080000-0x000000000A57E000-memory.dmp

    Filesize

    5.0MB

  • memory/1308-131-0x0000000004D70000-0x0000000004D71000-memory.dmp

    Filesize

    4KB

  • memory/1308-130-0x0000000008960000-0x00000000089D6000-memory.dmp

    Filesize

    472KB

  • memory/2724-116-0x0000000000690000-0x000000000069A000-memory.dmp

    Filesize

    40KB

  • memory/2724-115-0x0000000000690000-0x0000000000696000-memory.dmp

    Filesize

    24KB