Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17/01/2022, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
SearchIndexer.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SearchIndexer.exe
Resource
win10v2004-en-20220112
General
-
Target
SearchIndexer.exe
-
Size
91KB
-
MD5
1cc07a0274718e845c9b77f8334c4cb3
-
SHA1
12b6c08371fd4661ed2da442e7ec34f226d7ac01
-
SHA256
b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
-
SHA512
0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
Malware Config
Extracted
diamondfox
http://timesync.live/panel/gate.php
http://cartierxs.bit/panel/gate.php
http://salamsa.bit/panel/gate.php
http://rockababy.bit/panel/gate.php
http://minon.bit/panel/gate.php
http://bloxfox.bit/panel/gate.php
http://ggbbee.bit/panel/gate.php
http://locksock.bit/panel/gate.php
http://misosoup.bit/panel/gate.php
http://opseckes.bit/panel/gate.php
http://googletabmanager.com/panel/gate.php
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral1/files/0x0007000000013905-60.dat diamondfox behavioral1/files/0x0007000000013905-59.dat diamondfox behavioral1/files/0x0007000000013905-62.dat diamondfox -
Executes dropped EXE 1 IoCs
pid Process 760 SearchIndexer.exe -
Loads dropped DLL 2 IoCs
pid Process 592 powershell.exe 592 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 592 powershell.exe 592 powershell.exe 592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 592 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 960 SearchIndexer.exe 760 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 960 wrote to memory of 592 960 SearchIndexer.exe 27 PID 960 wrote to memory of 592 960 SearchIndexer.exe 27 PID 960 wrote to memory of 592 960 SearchIndexer.exe 27 PID 960 wrote to memory of 592 960 SearchIndexer.exe 27 PID 592 wrote to memory of 760 592 powershell.exe 31 PID 592 wrote to memory of 760 592 powershell.exe 31 PID 592 wrote to memory of 760 592 powershell.exe 31 PID 592 wrote to memory of 760 592 powershell.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-