Malware Analysis Report

2024-07-11 07:30

Sample ID 220503-a3h3wsgcdq
Target 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9
SHA256 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9
Tags
diamondfox botnet infostealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9

Threat Level: Known bad

The file 955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9 was found to be: Known bad.

Malicious Activity Summary

diamondfox botnet infostealer stealer

DiamondFox

DiamondFox payload

Suspicious use of SetThreadContext

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2022-05-03 00:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-03 00:44

Reported

2022-05-03 02:20

Platform

win7-20220414-en

Max time kernel

41s

Max time network

45s

Command Line

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-03 00:44

Reported

2022-05-03 02:21

Platform

win10v2004-20220414-en

Max time kernel

144s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

Signatures

DiamondFox

botnet stealer diamondfox

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2996 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2996 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2996 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 1128 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 1128 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 1128 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 2632 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe
PID 3668 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe

"C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\955a4e645d54f9d0215da60e28d8cbe7127664a55871c40055a42da800fc50d9.exe' -Destination 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\inchaearxre\SearchIndexer.exe'

Network

Country Destination Domain Proto
NL 20.190.160.75:443 tcp
US 29.44.101.158:587 tcp
NL 20.190.160.8:443 tcp
US 29.44.101.158:587 tcp
NL 8.238.24.126:80 tcp
NL 8.238.24.126:80 tcp
NL 20.190.160.67:443 tcp
US 29.44.101.158:587 tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
NL 20.190.160.4:443 tcp
IE 52.109.76.31:443 tcp
NL 20.190.160.71:443 tcp
NL 20.190.160.132:443 tcp

Files

memory/1128-130-0x0000000000000000-mapping.dmp

memory/2632-131-0x0000000000000000-mapping.dmp

memory/3668-132-0x0000000000000000-mapping.dmp

memory/3668-133-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3668-135-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3668-138-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2160-139-0x0000000000000000-mapping.dmp

memory/2160-140-0x0000000002650000-0x0000000002686000-memory.dmp

memory/2160-141-0x0000000005170000-0x0000000005798000-memory.dmp

memory/2160-142-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

memory/2160-143-0x0000000005810000-0x0000000005876000-memory.dmp

memory/2160-144-0x0000000005930000-0x0000000005996000-memory.dmp

memory/2160-145-0x0000000005F70000-0x0000000005F8E000-memory.dmp

memory/2160-146-0x00000000064E0000-0x0000000006576000-memory.dmp

memory/2160-147-0x0000000006460000-0x000000000647A000-memory.dmp

memory/2160-148-0x00000000064B0000-0x00000000064D2000-memory.dmp

memory/2160-149-0x00000000074E0000-0x0000000007A84000-memory.dmp

memory/2160-150-0x0000000008110000-0x000000000878A000-memory.dmp