diamondfox | 31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943

General

Target

31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe
Size

844KB
MD5

77144c51787f2eb142c2b4772712dbc4
SHA1

9a98a8e73bc7c77e4045c1e72011565d5d7a5759
SHA256

31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943
SHA512

7e3805f42e9a1f867575b65c5b434a1a27ee528dfd8a635669695a8366c07a5c2ad031ce47781400e3725dc1d228b3cc1fc0388314bdfd9bf9677a56157ee44c

Score

10^/10

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 1 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral1/memory/784-65-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29
PID 1188 wrote to memory of 784	1188	31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe	29

C:\Users\Admin\AppData\Local\Temp\31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe
"C:\Users\Admin\AppData\Local\Temp\31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe
  C:\Users\Admin\AppData\Local\Temp\31d0bdce494a1355821e8695c6fb4216173ccdeaf2e390e30b5222c15d485943.exe
  2⤵
  PID:784

memory/784-60-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/784-61-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/784-62-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/784-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/784-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/784-65-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1188-55-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/1188-56-0x00000000009F0000-0x0000000000AC8000-memory.dmp

Filesize
864KB

Download
memory/1188-57-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1188-58-0x0000000000300000-0x000000000032E000-memory.dmp

Filesize
184KB

Download
memory/1188-59-0x00000000008B0000-0x00000000008CC000-memory.dmp

Filesize
112KB

Download