diamondfox | new[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
new.exe
Size 213KB
Sample220327-s574xaacc7
SHA256 faafd3738a950abb74386aed1f629d7d635344e19057e55f51339bc1626be28f
MD5 0bc2f54c7442645c5a6e381301dffd60
SHA1 8e2eeab61459a78b73c14df11913300acd5d76d8
SHA512 779242b758699a5ce0663d5b0169a8818c18083e0a716ca3347d4877d369843ab519c208f5b8903215e860744e9e80d1fe133d5773d4282713e043a718637a02
MD5 SHA1 SHA512

Score

10^/10

infostealer diamondfox

Malware Config

Signatures

DiamondFox payload 1 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
sample	diamondfox

Diamondfox family
diamondfox

File Explorer

new.exe

.exe 213KB

new.exe

IMPHASH 8316bcd12417e59032ab566efaeaa8d5
SHA256 faafd3738a950abb74386aed1f629d7d635344e19057e55f51339bc1626be28f
MD5 0bc2f54c7442645c5a6e381301dffd60
SHA1 8e2eeab61459a78b73c14df11913300acd5d76d8
SHA512 779242b758699a5ce0663d5b0169a8818c18083e0a716ca3347d4877d369843ab519c208f5b8903215e860744e9e80d1fe133d5773d4282713e043a718637a02
MD5 SHA1 SHA512

windows x86

DiamondFox payload

Detects DiamondFox payload in file/memory.

infostealer

PE Signature issue

Digest

9c:69:fe:fd:da:26:e4:aa:21:b1:31:7f:cb:f4:79:e3:27:ae:36:7c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=TrustOcean Organization Software Vendor CA,O=TrustOcean Limited,C=US

Serial Number

79:77:ba:de:f6:83:54:84:b8:ce:b0:dd:2b:58:f4:08

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2020 - Jan 28, 2030

Subject

CN=IQ Trade ApS,O=IQ Trade ApS,POSTALCODE=2610,STREET=Prøvensvej 26,L=Rødovre,C=DK

Serial Number

06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e

Issuer

CN=TrustOcean Organization Software Vendor CA,O=TrustOcean Limited,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 25, 2021 - Mar 25, 2022

Minor OS version

Major OS version

Entry point

221184

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset memcpy wcslen wcscpy wcscat wcscmp memmove wcschr _CIlog floor ceil _CIpow strstr strlen _strnicmp strcmp strncpy strcpy sprintf _wcsicmp tolower wcsncpy fabs malloc free fseek ftell fread fclose pow ??3@YAXPAX@Z wcsncmp wcsstr _wcsnicmp _wcsdup _isnan _vsnwprintf cos fmod sin abs

kernel32

GetModuleHandleW HeapCreate CreateMutexW GetLastError HeapDestroy ExitProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId CloseHandle GetTickCount LoadLibraryW GetDiskFreeSpaceExW GetSystemPowerStatus CreateProcessW GetThreadContext ReadProcessMemory VirtualAllocEx WriteProcessMemory SetThreadContext ResumeThread TerminateProcess GetModuleFileNameW VirtualFree VirtualAlloc FreeLibrary VirtualProtect IsBadReadPtr EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateThread GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess DuplicateHandle CreatePipe GetStdHandle HeapAlloc HeapFree PeekNamedPipe GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile HeapReAlloc TlsAlloc TlsSetValue GetCurrentThreadId TlsGetValue GetProcAddress Sleep GetSystemInfo GlobalMemoryStatusEx GetComputerNameW CreateDirectoryW SetFileAttributesW CopyFileW DeleteFileW GetTempPathW GetDriveTypeW FindFirstFileW FindClose GetFileAttributesW WriteFile CreateFileW SetFilePointer GetFileSize WideCharToMultiByte GetVersionExW MultiByteToWideChar HeapSize TlsFree DeleteCriticalSection InterlockedCompareExchange InterlockedExchange SetLastError UnregisterWait GetCurrentThread RegisterWaitForSingleObject

gdiplus

GdiplusStartup GdipCreateBitmapFromFile GdipSaveImageToFile GdipDisposeImage GdiplusShutdown GdipDeleteFont GdipDeleteGraphics GdipDeletePath GdipDeleteMatrix GdipDeletePen GdipDeleteStringFormat GdipFree GdipGetDpiX GdipGetDpiY

user32

GetSystemMetrics GetCursorPos GetDC ReleaseDC DestroyIcon FillRect CharUpperW CharLowerW GetIconInfo DrawIconEx

gdi32

BitBlt GetObjectType DeleteObject GetObjectW CreateCompatibleDC SelectObject CreateSolidBrush DeleteDC GdiGetBatchLimit GdiSetBatchLimit CreateDIBSection CreateBitmap SetPixel GetStockObject GetDIBits CreateDCW GetDeviceCaps GetTextExtentPoint32W SetBkMode SetTextAlign SetBkColor SetTextColor TextOutW SetStretchBltMode SetBrushOrgEx StretchBlt CreateFontIndirectW GetTextMetricsW CreateCompatibleBitmap GetPixel

advapi32

RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegQueryValueExW GetUserNameW

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteExW

wsock32

closesocket WSACleanup WSAStartup

winmm

timeBeginPeriod

shlwapi

PathFileExistsW

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree

ntdll

ZwUnmapViewOfSection

setupapi

IsUserAdmin

urlmon

URLDownloadToFileW

wininet

InternetOpenW InternetSetOptionW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetReadFile InternetCloseHandle InternetGetConnectedState