Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 00:44
Static task
static1
Behavioral task
behavioral1
Sample
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
Resource
win10v2004-20220414-en
General
-
Target
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
-
Size
185KB
-
MD5
52030482b9b1dee8ae1aea7b0046413f
-
SHA1
8e39078bd8edb9607facd4014ebcf34f2a12728a
-
SHA256
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9
-
SHA512
3052ab0331aca7831cbdbc165b7f2e1f8a4819343a8724fc20ac652a8c2695357d3fa1aecc01d95175e47bc9bde90c12005dd8fdf15fb4a88ed055010fb6a12f
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Processes:
resource yara_rule behavioral2/memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox behavioral2/memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox behavioral2/memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox -
Suspicious use of SetThreadContext 1 IoCs
Processes:
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exedescription pid process target process PID 2632 set thread context of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2160 powershell.exe 2160 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2160 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exepid process 3668 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exedescription pid process target process PID 2996 wrote to memory of 1128 2996 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2996 wrote to memory of 1128 2996 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2996 wrote to memory of 1128 2996 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 1128 wrote to memory of 2632 1128 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 1128 wrote to memory of 2632 1128 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 1128 wrote to memory of 2632 1128 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 2632 wrote to memory of 3668 2632 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe PID 3668 wrote to memory of 2160 3668 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe powershell.exe PID 3668 wrote to memory of 2160 3668 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe powershell.exe PID 3668 wrote to memory of 2160 3668 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe' -Destination 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-130-0x0000000000000000-mapping.dmp
-
memory/2160-145-0x0000000005F70000-0x0000000005F8E000-memory.dmpFilesize
120KB
-
memory/2160-147-0x0000000006460000-0x000000000647A000-memory.dmpFilesize
104KB
-
memory/2160-142-0x0000000004FB0000-0x0000000004FD2000-memory.dmpFilesize
136KB
-
memory/2160-150-0x0000000008110000-0x000000000878A000-memory.dmpFilesize
6.5MB
-
memory/2160-143-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/2160-139-0x0000000000000000-mapping.dmp
-
memory/2160-140-0x0000000002650000-0x0000000002686000-memory.dmpFilesize
216KB
-
memory/2160-144-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/2160-149-0x00000000074E0000-0x0000000007A84000-memory.dmpFilesize
5.6MB
-
memory/2160-148-0x00000000064B0000-0x00000000064D2000-memory.dmpFilesize
136KB
-
memory/2160-141-0x0000000005170000-0x0000000005798000-memory.dmpFilesize
6.2MB
-
memory/2160-146-0x00000000064E0000-0x0000000006576000-memory.dmpFilesize
600KB
-
memory/2632-131-0x0000000000000000-mapping.dmp
-
memory/3668-132-0x0000000000000000-mapping.dmp
-
memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB