Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4265077s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17/01/2022, 04:18

General

  • Target

    SearchIndexer.exe

  • Size

    91KB

  • MD5

    1cc07a0274718e845c9b77f8334c4cb3

  • SHA1

    12b6c08371fd4661ed2da442e7ec34f226d7ac01

  • SHA256

    b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

  • SHA512

    0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

Malware Config

Extracted

Family

diamondfox

C2

http://timesync.live/panel/gate.php

http://cartierxs.bit/panel/gate.php

http://salamsa.bit/panel/gate.php

http://rockababy.bit/panel/gate.php

http://minon.bit/panel/gate.php

http://bloxfox.bit/panel/gate.php

http://ggbbee.bit/panel/gate.php

http://locksock.bit/panel/gate.php

http://misosoup.bit/panel/gate.php

http://opseckes.bit/panel/gate.php

http://googletabmanager.com/panel/gate.php

Mutex

cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS

xor.plain

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

  • DiamondFox payload 2 IoCs

    Detects DiamondFox payload in file/memory.

  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe
        "C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3144
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3048-130-0x0000000002170000-0x0000000002176000-memory.dmp

    Filesize

    24KB

  • memory/3048-131-0x0000000002170000-0x000000000217A000-memory.dmp

    Filesize

    40KB

  • memory/3144-153-0x00000000004B0000-0x00000000004BA000-memory.dmp

    Filesize

    40KB

  • memory/3144-152-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/3668-142-0x00000000069F0000-0x0000000006A0E000-memory.dmp

    Filesize

    120KB

  • memory/3668-146-0x00000000081A0000-0x00000000081C2000-memory.dmp

    Filesize

    136KB

  • memory/3668-139-0x0000000006C80000-0x0000000006CA2000-memory.dmp

    Filesize

    136KB

  • memory/3668-140-0x0000000006E20000-0x0000000006E86000-memory.dmp

    Filesize

    408KB

  • memory/3668-141-0x0000000007570000-0x00000000075D6000-memory.dmp

    Filesize

    408KB

  • memory/3668-137-0x0000000006890000-0x0000000006891000-memory.dmp

    Filesize

    4KB

  • memory/3668-143-0x0000000006895000-0x0000000006897000-memory.dmp

    Filesize

    8KB

  • memory/3668-144-0x00000000081F0000-0x0000000008286000-memory.dmp

    Filesize

    600KB

  • memory/3668-145-0x0000000008150000-0x000000000816A000-memory.dmp

    Filesize

    104KB

  • memory/3668-138-0x0000000006892000-0x0000000006893000-memory.dmp

    Filesize

    4KB

  • memory/3668-147-0x00000000092B0000-0x0000000009854000-memory.dmp

    Filesize

    5.6MB

  • memory/3668-148-0x0000000009EE0000-0x000000000A55A000-memory.dmp

    Filesize

    6.5MB

  • memory/3668-136-0x0000000006ED0000-0x00000000074F8000-memory.dmp

    Filesize

    6.2MB

  • memory/3668-135-0x0000000000EC0000-0x0000000000EF6000-memory.dmp

    Filesize

    216KB

  • memory/3668-133-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/3668-134-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/3668-154-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB