Analysis
-
max time kernel
4294192s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
14-04-2022 06:51
General
-
Target
ISF-10+2 ?? WTXLAX200007.scr
-
Size
811KB
-
MD5
ab74af82928f328979d85af5db7debab
-
SHA1
07476d19fa25fafdec37767eb06ca91a4caf2ee9
-
SHA256
8616545829272fd918765d945bb44e610852b995be21965577b77cfea4868007
-
SHA512
87d6658f8a402f65897a1b83289b7bbbdc7be14f7632262175c06b34f7b6337048618c59b12de7a7c422b62ff7816bdc7f14371050bb44dc5430dd3e2fbff156
Score
10/10
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 4 IoCs
Detects DiamondFox payload in file/memory.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr' -Destination 'C:\Users\Admin\AppData\Local\hostocn\conhost.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\hostocn\conhost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
288KB
-
Filesize
840KB
-
Filesize
392KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
5.7MB