Analysis
- max time kernel
117s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
14/04/2022, 06:51
General
- Target ISF-10+2 ?? WTXLAX200007.scr
- Size 811KB
- Sample220414-hmttfsadc2
- SHA256 8616545829272fd918765d945bb44e610852b995be21965577b77cfea4868007
Malware Config
Signatures
- DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
- DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\ISF-10+2 __ WTXLAX200007.scr' -Destination 'C:\Users\Admin\AppData\Local\hostocn\conhost.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\hostocn\conhost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1676-134-0x00000000004E0000-0x00000000005B2000-memory.dmp
memory/1676-135-0x0000000004F70000-0x000000000500C000-memory.dmp
memory/1676-136-0x00000000055C0000-0x0000000005B64000-memory.dmp
memory/1676-137-0x00000000050B0000-0x0000000005142000-memory.dmp
memory/1676-138-0x0000000005010000-0x000000000501A000-memory.dmp
memory/1676-139-0x0000000005240000-0x0000000005296000-memory.dmp
memory/1728-147-0x0000000000400000-0x000000000041A000-memory.dmp
memory/1728-142-0x0000000000400000-0x000000000041A000-memory.dmp
memory/1728-144-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3280-151-0x0000000005960000-0x0000000005982000-memory.dmp
memory/3280-149-0x0000000003000000-0x0000000003036000-memory.dmp
memory/3280-150-0x0000000005A10000-0x0000000006038000-memory.dmp
memory/3280-152-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/3280-153-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/3280-154-0x00000000056A0000-0x00000000056BE000-memory.dmp
memory/3280-155-0x0000000002FA0000-0x0000000002FB0000-memory.dmp
memory/3280-156-0x0000000006E80000-0x0000000006F16000-memory.dmp
memory/3280-157-0x0000000006E00000-0x0000000006E1A000-memory.dmp
memory/3280-158-0x0000000006E50000-0x0000000006E72000-memory.dmp
memory/3280-159-0x0000000008B00000-0x000000000917A000-memory.dmp