Analysis Overview
SHA256
955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9
Threat Level: Known bad
The file 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9 was found to be: Known bad.
Malicious Activity Summary
DiamondFox
DiamondFox payload
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2022-05-03 00:44
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-03 00:44
Reported
2022-05-03 02:20
Platform
win7-20220414-en
Max time kernel
41s
Max time network
45s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-03 00:44
Reported
2022-05-03 02:21
Platform
win10v2004-20220414-en
Max time kernel
144s
Max time network
155s
Command Line
Signatures
DiamondFox
DiamondFox payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2632 set thread context of 3668 | N/A | C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe | C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe' -Destination 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe'
Network
| Country | Destination | Domain | Proto |
| NL | 20.190.160.75:443 | tcp | |
| US | 29.44.101.158:587 | tcp | |
| NL | 20.190.160.8:443 | tcp | |
| US | 29.44.101.158:587 | tcp | |
| NL | 8.238.24.126:80 | tcp | |
| NL | 8.238.24.126:80 | tcp | |
| NL | 20.190.160.67:443 | tcp | |
| US | 29.44.101.158:587 | tcp | |
| US | 8.8.8.8:53 | 15.89.54.20.in-addr.arpa | udp |
| NL | 20.190.160.4:443 | tcp | |
| IE | 52.109.76.31:443 | tcp | |
| NL | 20.190.160.71:443 | tcp | |
| NL | 20.190.160.132:443 | tcp |
Files
memory/1128-130-0x0000000000000000-mapping.dmp
memory/2632-131-0x0000000000000000-mapping.dmp
memory/3668-132-0x0000000000000000-mapping.dmp
memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmp
memory/2160-139-0x0000000000000000-mapping.dmp
memory/2160-140-0x0000000002650000-0x0000000002686000-memory.dmp
memory/2160-141-0x0000000005170000-0x0000000005798000-memory.dmp
memory/2160-142-0x0000000004FB0000-0x0000000004FD2000-memory.dmp
memory/2160-143-0x0000000005810000-0x0000000005876000-memory.dmp
memory/2160-144-0x0000000005930000-0x0000000005996000-memory.dmp
memory/2160-145-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/2160-146-0x00000000064E0000-0x0000000006576000-memory.dmp
memory/2160-147-0x0000000006460000-0x000000000647A000-memory.dmp
memory/2160-148-0x00000000064B0000-0x00000000064D2000-memory.dmp
memory/2160-149-0x00000000074E0000-0x0000000007A84000-memory.dmp
memory/2160-150-0x0000000008110000-0x000000000878A000-memory.dmp