diamondfox | 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9

General

Target

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
Size

185KB
MD5

52030482b9b1dee8ae1aea7b0046413f
SHA1

8e39078bd8edb9607facd4014ebcf34f2a12728a
SHA256

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9
SHA512

3052ab0331aca7831cbdbc165b7f2e1f8a4819343a8724fc20ac652a8c2695357d3fa1aecc01d95175e47bc9bde90c12005dd8fdf15fb4a88ed055010fb6a12f

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 3 IoCs

Detects DiamondFox payload in file/memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral2/memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox
behavioral2/memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmp	diamondfox

Suspicious use of SetThreadContext 1 IoCs

Processes:

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

description	pid	Process	procid_target
PID 2632 set thread context of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid	Process
2160	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2160	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

pid	Process
3668	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

description	pid	Process	procid_target
PID 2996 wrote to memory of 1128	2996	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	81
PID 2996 wrote to memory of 1128	2996	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	81
PID 2996 wrote to memory of 1128	2996	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	81
PID 1128 wrote to memory of 2632	1128	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	84
PID 1128 wrote to memory of 2632	1128	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	84
PID 1128 wrote to memory of 2632	1128	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	84
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 2632 wrote to memory of 3668	2632	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	85
PID 3668 wrote to memory of 2160	3668	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	86
PID 3668 wrote to memory of 2160	3668	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	86
PID 3668 wrote to memory of 2160	3668	955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe	86

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
  "C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
    "C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
      "C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe' -Destination 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-130-0x0000000000000000-mapping.dmp

Download
memory/2160-145-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/2160-147-0x0000000006460000-0x000000000647A000-memory.dmp

Filesize
104KB

Download
memory/2160-142-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Filesize
136KB

Download
memory/2160-150-0x0000000008110000-0x000000000878A000-memory.dmp

Filesize
6.5MB

Download
memory/2160-143-0x0000000005810000-0x0000000005876000-memory.dmp

Filesize
408KB

Download
memory/2160-139-0x0000000000000000-mapping.dmp

Download
memory/2160-140-0x0000000002650000-0x0000000002686000-memory.dmp

Filesize
216KB

Download
memory/2160-144-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/2160-149-0x00000000074E0000-0x0000000007A84000-memory.dmp

Filesize
5.6MB

Download
memory/2160-148-0x00000000064B0000-0x00000000064D2000-memory.dmp

Filesize
136KB

Download
memory/2160-141-0x0000000005170000-0x0000000005798000-memory.dmp

Filesize
6.2MB

Download
memory/2160-146-0x00000000064E0000-0x0000000006576000-memory.dmp

Filesize
600KB

Download
memory/2632-131-0x0000000000000000-mapping.dmp

Download
memory/3668-132-0x0000000000000000-mapping.dmp

Download
memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads