Overview

overview

10

Static

static

nine.exe

windows7_x64

10

nine.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nine.exe

  • Size

    210KB

  • Sample

    220117-rgacasahel

  • MD5

    4440d9bb248b6ecb966eef7af0ec276c

  • SHA1

    dba8eb889861da4252bc2aca9794062a87fb6056

  • SHA256

    93e7ecd77057b7388f80a012e15977613f6fa01bda350e684facdce6fee8e1da

  • SHA512

    95abb7d39550c8b4b775d98e859e10eca7aa22193becd8656632b87689388c094ce872bf2aa0f24732d965b03ffa65f99e48774941c58779802e501d9bb610d6

Score
10/10
diamondfoxbotnetstealer

Malware Config

Targets

    • Target

      nine.exe

    • Size

      210KB

    • MD5

      4440d9bb248b6ecb966eef7af0ec276c

    • SHA1

      dba8eb889861da4252bc2aca9794062a87fb6056

    • SHA256

      93e7ecd77057b7388f80a012e15977613f6fa01bda350e684facdce6fee8e1da

    • SHA512

      95abb7d39550c8b4b775d98e859e10eca7aa22193becd8656632b87689388c094ce872bf2aa0f24732d965b03ffa65f99e48774941c58779802e501d9bb610d6

    Score
    10/10
    diamondfoxbotnetstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks