Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 08:50
Static task
static1
Behavioral task
behavioral1
Sample
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe
Resource
win10v2004-20220414-en
General
-
Target
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe
-
Size
524KB
-
MD5
fed8da31116c682583f8535307840f37
-
SHA1
8fe062149c227c72f267b6e48249a63ae1e53c5b
-
SHA256
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
-
SHA512
d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Processes:
resource yara_rule behavioral1/memory/1828-56-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox behavioral1/memory/1828-60-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox behavioral1/memory/2028-77-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox -
Executes dropped EXE 2 IoCs
Processes:
SearchIndexer.exeSearchIndexer.exepid process 1608 SearchIndexer.exe 2028 SearchIndexer.exe -
Loads dropped DLL 2 IoCs
Processes:
powershell.exepid process 948 powershell.exe 948 powershell.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exepowershell.exeSearchIndexer.exepid process 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 948 powershell.exe 948 powershell.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe 1608 SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 948 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exeSearchIndexer.exepid process 1828 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 2028 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exepowershell.exeSearchIndexer.exedescription pid process target process PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1420 wrote to memory of 1828 1420 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe PID 1828 wrote to memory of 948 1828 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe powershell.exe PID 1828 wrote to memory of 948 1828 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe powershell.exe PID 1828 wrote to memory of 948 1828 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe powershell.exe PID 1828 wrote to memory of 948 1828 4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe powershell.exe PID 948 wrote to memory of 1608 948 powershell.exe SearchIndexer.exe PID 948 wrote to memory of 1608 948 powershell.exe SearchIndexer.exe PID 948 wrote to memory of 1608 948 powershell.exe SearchIndexer.exe PID 948 wrote to memory of 1608 948 powershell.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe PID 1608 wrote to memory of 2028 1608 SearchIndexer.exe SearchIndexer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe"C:\Users\Admin\AppData\Local\Temp\4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe"C:\Users\Admin\AppData\Local\Temp\4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\4c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exeFilesize
524KB
MD5fed8da31116c682583f8535307840f37
SHA18fe062149c227c72f267b6e48249a63ae1e53c5b
SHA2564c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
SHA512d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exeFilesize
524KB
MD5fed8da31116c682583f8535307840f37
SHA18fe062149c227c72f267b6e48249a63ae1e53c5b
SHA2564c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
SHA512d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
-
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exeFilesize
524KB
MD5fed8da31116c682583f8535307840f37
SHA18fe062149c227c72f267b6e48249a63ae1e53c5b
SHA2564c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
SHA512d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
-
\Users\Admin\AppData\Local\xerasr\SearchIndexer.exeFilesize
524KB
MD5fed8da31116c682583f8535307840f37
SHA18fe062149c227c72f267b6e48249a63ae1e53c5b
SHA2564c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
SHA512d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
-
\Users\Admin\AppData\Local\xerasr\SearchIndexer.exeFilesize
524KB
MD5fed8da31116c682583f8535307840f37
SHA18fe062149c227c72f267b6e48249a63ae1e53c5b
SHA2564c374a28f93443eddaeb03cb789b18e38b7e797620d06c17e83684884377f34b
SHA512d73be00a35cd1bbcef7765c8fe3d7438ef360c897e0ccf97839d3953cb449b6c1be3536c28e49ef0921f893d4432c7957a3e8177a27dc68a8f66d5c510a6c375
-
memory/948-64-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/948-63-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/948-61-0x0000000000000000-mapping.dmp
-
memory/948-62-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/1420-57-0x00000000028D0000-0x0000000002A50000-memory.dmpFilesize
1.5MB
-
memory/1420-54-0x0000000000490000-0x000000000050B000-memory.dmpFilesize
492KB
-
memory/1608-72-0x0000000001EA0000-0x0000000001F1B000-memory.dmpFilesize
492KB
-
memory/1608-67-0x0000000000000000-mapping.dmp
-
memory/1608-75-0x00000000029A0000-0x0000000002B20000-memory.dmpFilesize
1.5MB
-
memory/1828-56-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1828-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1828-55-0x0000000000000000-mapping.dmp
-
memory/2028-70-0x0000000000000000-mapping.dmp
-
memory/2028-77-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB