diamondfox | new[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
new.exe
Size 590KB
Sample220512-shkebsheb8
SHA256 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
MD5 d0adc891c2d75a5750a0762418fa0f23
SHA1 bfbbc833f3f85d693139b43002181fab5ff8da1d
SHA512 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f
SSDEEP 12288:mO+B4it8xokZmFjvToKk5ZzdLHOVWeTfg5ZzdLHOVWeTf:g4iuokZOvTf4Z0WegZ0We
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

infostealer diamondfox

Malware Config

Signatures

DiamondFox payload 1 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
sample	diamondfox

Diamondfox family
diamondfox

File Explorer

new.exe

.exe 590KB

new.exe

IMPHASH 8316bcd12417e59032ab566efaeaa8d5
SHA256 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
MD5 d0adc891c2d75a5750a0762418fa0f23
SHA1 bfbbc833f3f85d693139b43002181fab5ff8da1d
SHA512 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f
SSDEEP 12288:mO+B4it8xokZmFjvToKk5ZzdLHOVWeTfg5ZzdLHOVWeTf:g4iuokZOvTf4Z0WegZ0We
MD5 SHA1 SHA512 SSDEEP

windows x86

DiamondFox payload

Detects DiamondFox payload in file/memory.

infostealer

PE Signature issue

Digest

92:94:5a:de:3a:e0:d2:dc:0f:4f:02:23:d9:0f:2f:15:c9:6f:e0:f9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=TrustOcean Organization Software Vendor CA,O=TrustOcean Limited,C=US

Serial Number

79:77:ba:de:f6:83:54:84:b8:ce:b0:dd:2b:58:f4:08

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2020 - Jan 28, 2030

Subject

CN=IQ Trade ApS,O=IQ Trade ApS,POSTALCODE=2610,STREET=Prøvensvej 26,L=Rødovre,C=DK

Serial Number

06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e

Issuer

CN=TrustOcean Organization Software Vendor CA,O=TrustOcean Limited,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 25, 2021 - Mar 25, 2022

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_NO_BIND IMAGE_DLLCHARACTERISTICS_WDM_DRIVER IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

msvcrt

memset memcpy wcslen wcscpy wcscat wcscmp memmove wcschr _CIlog floor ceil _CIpow strstr strlen _strnicmp strcmp strncpy strcpy sprintf _wcsicmp tolower wcsncpy fabs malloc free fseek ftell fread fclose pow ??3@YAXPAX@Z wcsncmp wcsstr _wcsnicmp _wcsdup _isnan _vsnwprintf cos fmod sin abs

kernel32

GetModuleHandleW HeapCreate CreateMutexW GetLastError HeapDestroy ExitProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId CloseHandle GetTickCount LoadLibraryW GetDiskFreeSpaceExW GetSystemPowerStatus CreateProcessW GetThreadContext ReadProcessMemory VirtualAllocEx WriteProcessMemory SetThreadContext ResumeThread TerminateProcess GetModuleFileNameW VirtualFree VirtualAlloc FreeLibrary VirtualProtect IsBadReadPtr EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateThread GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess DuplicateHandle CreatePipe GetStdHandle HeapAlloc HeapFree PeekNamedPipe GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile HeapReAlloc TlsAlloc TlsSetValue GetCurrentThreadId TlsGetValue GetProcAddress Sleep GetSystemInfo GlobalMemoryStatusEx GetComputerNameW CreateDirectoryW SetFileAttributesW CopyFileW DeleteFileW GetTempPathW GetDriveTypeW FindFirstFileW FindClose GetFileAttributesW WriteFile CreateFileW SetFilePointer GetFileSize WideCharToMultiByte GetVersionExW MultiByteToWideChar HeapSize TlsFree DeleteCriticalSection InterlockedCompareExchange InterlockedExchange SetLastError UnregisterWait GetCurrentThread RegisterWaitForSingleObject

gdiplus

GdiplusStartup GdipCreateBitmapFromFile GdipSaveImageToFile GdipDisposeImage GdiplusShutdown GdipDeleteFont GdipDeleteGraphics GdipDeletePath GdipDeleteMatrix GdipDeletePen GdipDeleteStringFormat GdipFree GdipGetDpiX GdipGetDpiY

user32

GetSystemMetrics GetCursorPos GetDC ReleaseDC DestroyIcon FillRect CharUpperW CharLowerW GetIconInfo DrawIconEx

gdi32

BitBlt GetObjectType DeleteObject GetObjectW CreateCompatibleDC SelectObject CreateSolidBrush DeleteDC GdiGetBatchLimit GdiSetBatchLimit CreateDIBSection CreateBitmap SetPixel GetStockObject GetDIBits CreateDCW GetDeviceCaps GetTextExtentPoint32W SetBkMode SetTextAlign SetBkColor SetTextColor TextOutW SetStretchBltMode SetBrushOrgEx StretchBlt CreateFontIndirectW GetTextMetricsW CreateCompatibleBitmap GetPixel

advapi32

RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegQueryValueExW GetUserNameW

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteExW

wsock32

closesocket WSACleanup WSAStartup

winmm

timeBeginPeriod

shlwapi

PathFileExistsW

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree

ntdll

ZwUnmapViewOfSection

setupapi

IsUserAdmin

urlmon

URLDownloadToFileW

wininet

InternetOpenW InternetSetOptionW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetReadFile InternetCloseHandle InternetGetConnectedState

Name

.code

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.00cfg

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ