Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:31
Static task
static1
Behavioral task
behavioral1
Sample
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe
Resource
win10v2004-20220414-en
General
-
Target
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe
-
Size
231KB
-
MD5
c8830b9e611ef52f5d4dcddee87c2ba1
-
SHA1
fc7f516a1cc9916405e1f15f0be2432b356efe86
-
SHA256
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8
-
SHA512
dca8de414cf9d841283184931d9977a299ad7ac47019330a464c10a69e2e9c98131c2e7cfdb658494c1f32975efde3f58128f2fcaad1046c8f495b6af8d845a9
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Processes:
resource yara_rule behavioral2/memory/4224-133-0x0000000000B30000-0x0000000000B48000-memory.dmp diamondfox behavioral2/memory/4224-134-0x0000000000400000-0x000000000098D000-memory.dmp diamondfox behavioral2/memory/4524-153-0x0000000000400000-0x000000000098D000-memory.dmp diamondfox -
Executes dropped EXE 1 IoCs
Processes:
audiodg.exepid process 4524 audiodg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1940 4224 WerFault.exe 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4136 powershell.exe 4136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4136 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exeaudiodg.exepid process 4224 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe 4524 audiodg.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exepowershell.exedescription pid process target process PID 4224 wrote to memory of 4136 4224 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe powershell.exe PID 4224 wrote to memory of 4136 4224 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe powershell.exe PID 4224 wrote to memory of 4136 4224 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe powershell.exe PID 4136 wrote to memory of 4524 4136 powershell.exe audiodg.exe PID 4136 wrote to memory of 4524 4136 powershell.exe audiodg.exe PID 4136 wrote to memory of 4524 4136 powershell.exe audiodg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe"C:\Users\Admin\AppData\Local\Temp\0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8.exe' -Destination 'C:\Users\Admin\AppData\Local\gduaido\audiodg.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\gduaido\audiodg.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\gduaido\audiodg.exe"C:\Users\Admin\AppData\Local\gduaido\audiodg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 4962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4224 -ip 42241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\gduaido\audiodg.exeFilesize
231KB
MD5c8830b9e611ef52f5d4dcddee87c2ba1
SHA1fc7f516a1cc9916405e1f15f0be2432b356efe86
SHA2560111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8
SHA512dca8de414cf9d841283184931d9977a299ad7ac47019330a464c10a69e2e9c98131c2e7cfdb658494c1f32975efde3f58128f2fcaad1046c8f495b6af8d845a9
-
C:\Users\Admin\AppData\Local\gduaido\audiodg.exeFilesize
231KB
MD5c8830b9e611ef52f5d4dcddee87c2ba1
SHA1fc7f516a1cc9916405e1f15f0be2432b356efe86
SHA2560111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8
SHA512dca8de414cf9d841283184931d9977a299ad7ac47019330a464c10a69e2e9c98131c2e7cfdb658494c1f32975efde3f58128f2fcaad1046c8f495b6af8d845a9
-
memory/4136-137-0x0000000005A80000-0x00000000060A8000-memory.dmpFilesize
6MB
-
memory/4136-142-0x0000000007970000-0x0000000007A06000-memory.dmpFilesize
600KB
-
memory/4136-136-0x0000000003080000-0x00000000030B6000-memory.dmpFilesize
216KB
-
memory/4136-146-0x0000000008BF0000-0x000000000926A000-memory.dmpFilesize
6MB
-
memory/4136-138-0x00000000059C0000-0x00000000059E2000-memory.dmpFilesize
136KB
-
memory/4136-139-0x00000000060B0000-0x0000000006116000-memory.dmpFilesize
408KB
-
memory/4136-140-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/4136-141-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/4136-143-0x0000000006E60000-0x0000000006E7A000-memory.dmpFilesize
104KB
-
memory/4136-135-0x0000000000000000-mapping.dmp
-
memory/4136-144-0x0000000006EC0000-0x0000000006EE2000-memory.dmpFilesize
136KB
-
memory/4136-145-0x0000000007FC0000-0x0000000008564000-memory.dmpFilesize
5MB
-
memory/4224-132-0x0000000000B69000-0x0000000000B75000-memory.dmpFilesize
48KB
-
memory/4224-134-0x0000000000400000-0x000000000098D000-memory.dmpFilesize
5MB
-
memory/4224-133-0x0000000000B30000-0x0000000000B48000-memory.dmpFilesize
96KB
-
memory/4524-147-0x0000000000000000-mapping.dmp
-
memory/4524-152-0x0000000000B49000-0x0000000000B55000-memory.dmpFilesize
48KB
-
memory/4524-153-0x0000000000400000-0x000000000098D000-memory.dmpFilesize
5MB