diamondfox | 7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4

General

Target

7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
Size

448KB
MD5

7edf68b4698f46dd331b51df7d06949a
SHA1

ca4705f939d2d6e8fa5c4fe73d064eb52cb00497
SHA256

7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4
SHA512

95bac4d8b791c726ee1d0299592cab69c35a1081ed4becf41cb7d80f699a2576fa798296219c578cc48ff14da9f847b075f5acb8aef2d554d0efeb0d757d450f

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 1 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral1/memory/1212-58-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	1212	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1924 wrote to memory of 1212	1924	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	27
PID 1212 wrote to memory of 268	1212	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	28
PID 1212 wrote to memory of 268	1212	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	28
PID 1212 wrote to memory of 268	1212	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	28
PID 1212 wrote to memory of 268	1212	7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe	28

C:\Users\Admin\AppData\Local\Temp\7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
"C:\Users\Admin\AppData\Local\Temp\7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe
  "C:\Users\Admin\AppData\Local\Temp\7da4487d62a6800179765c4eebdbf764872a8325245bc5b77a9dcd318c22f7a4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 144
    3⤵
    - Program crash
    PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1212-60-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1924-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1924-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1924-56-0x0000000000240000-0x00000000002BB000-memory.dmp

Filesize
492KB

Download
memory/1924-57-0x0000000077120000-0x00000000772A0000-memory.dmp

Filesize
1.5MB

Download
memory/1924-59-0x0000000002A80000-0x0000000002C00000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing