diamondfox | f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa

General

Target

f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe
Size

280KB
MD5

97c9fa3b3153cadbe647ae702bd2ba79
SHA1

6d5418b379a612f9fa09f928b8a30ce44e2388c6
SHA256

f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa
SHA512

1df977afbee7fb415f66003883192d66e6520e25fbcf6382e08b8f943b00b6d7b3a1edee7f0e22d202829424aa6a854e22e5f4dd70d23e0b0238b969cd2e98bb

Score

10^/10

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 2 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral2/memory/3148-136-0x00000000001C0000-0x00000000001D8000-memory.dmp	diamondfox
behavioral2/memory/3148-137-0x0000000000400000-0x00000000004CC000-memory.dmp	diamondfox

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	3148	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	powershell.exe
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3148	f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2596	3148	f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe	90
PID 3148 wrote to memory of 2596	3148	f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe	90
PID 3148 wrote to memory of 2596	3148	f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe	90

C:\Users\Admin\AppData\Local\Temp\f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe
"C:\Users\Admin\AppData\Local\Temp\f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\f52e9051e15c25fc3ed5e86168cf79e8e1f5f71b336878044892c733d60d89fa.exe' -Destination 'C:\Users\Admin\AppData\Local\xdaeitx\atiedxx.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xdaeitx\atiedxx.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 496
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3148 -ip 3148
1⤵
PID:2616

memory/2596-145-0x00000000056A0000-0x00000000056C2000-memory.dmp

Filesize
136KB

Download
memory/2596-140-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/2596-141-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/2596-142-0x0000000002D20000-0x0000000002D56000-memory.dmp

Filesize
216KB

Download
memory/2596-143-0x00000000052D2000-0x00000000052D3000-memory.dmp

Filesize
4KB

Download
memory/2596-144-0x0000000005910000-0x0000000005F38000-memory.dmp

Filesize
6.2MB

Download
memory/2596-146-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/2596-147-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/2596-148-0x0000000006650000-0x000000000666E000-memory.dmp

Filesize
120KB

Download
memory/3148-135-0x0000000000502000-0x000000000050D000-memory.dmp

Filesize
44KB

Download
memory/3148-136-0x00000000001C0000-0x00000000001D8000-memory.dmp

Filesize
96KB

Download
memory/3148-137-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3148-134-0x0000000000502000-0x000000000050D000-memory.dmp

Filesize
44KB

Download