Malware Analysis Report

2024-07-11 07:30

Sample ID 221025-wehccadcg7
Target 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.zip
SHA256 a5ce92e7e63bf447b0d2591484d012b8491221c6a27bf2ae87d9a5678f7d09e9
Tags
diamondfox botnet evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5ce92e7e63bf447b0d2591484d012b8491221c6a27bf2ae87d9a5678f7d09e9

Threat Level: Known bad

The file 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.zip was found to be: Known bad.

Malicious Activity Summary

diamondfox botnet evasion persistence stealer trojan

Windows security bypass

UAC bypass

DiamondFox

Executes dropped EXE

Windows security modification

Loads dropped DLL

Drops startup file

Deletes itself

Adds Run key to start application

Checks whether UAC is enabled

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-10-25 17:49

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-25 17:49

Reported

2022-10-25 18:00

Platform

win10v2004-20220812-en

Max time kernel

508s

Max time network

511s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe"

Signatures

DiamondFox

botnet stealer diamondfox

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\run C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\\explorer.exe" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Enumerates physical storage devices

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe"

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\A719DFB7.cmd

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 8.8.8.8:53 www.microsoft.com udp
NL 104.85.1.163:80 www.microsoft.com tcp
US 8.8.8.8:53 someexampledomain.com udp
US 93.184.221.240:80 tcp
US 20.189.173.7:443 tcp
US 13.107.4.50:80 tcp
US 13.107.4.50:80 tcp
US 13.107.4.50:80 tcp

Files

memory/3604-134-0x0000000000400000-0x000000000041016C-memory.dmp

memory/4680-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

memory/4532-140-0x0000000000000000-mapping.dmp

memory/3604-141-0x0000000000400000-0x000000000041016C-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A719DFB7.cmd

MD5 c1646375a5134f7a8de899466c386861
SHA1 82aa1e446057825ef52c2e79afba5ec764500bce
SHA256 39d876a60c4cef3cd459eff8af7abb814e18268a74f18f2ae8d4b145268c297e
SHA512 c426ac24bc77b2bf369435843d953a65072dfa3d7ce4d8d77df80bb1786a68f5f8d5b8f76303752ed6b69b41a987c45a7c5f97b094977efa00fc14cce029db2f

memory/4680-143-0x0000000000400000-0x000000000041016C-memory.dmp

memory/4680-144-0x0000000000400000-0x000000000041016C-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2022-10-25 17:49

Reported

2022-10-25 18:00

Platform

win7-20220901-en

Max time kernel

417s

Max time network

421s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe"

Network

N/A

Files

memory/1408-54-0x0000000000400000-0x000000000041016C-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2022-10-25 17:49

Reported

2022-10-25 18:00

Platform

win10v2004-20220812-en

Max time kernel

481s

Max time network

483s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f_dump_0x00400000.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4876 -ip 4876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 216

Network

Country Destination Domain Proto
US 13.89.178.27:443 tcp
NL 104.80.225.205:443 tcp
US 8.249.91.254:80 tcp
US 8.249.91.254:80 tcp
US 8.249.91.254:80 tcp
US 93.184.221.240:80 tcp

Files

memory/4876-132-0x0000000000400000-0x000000000041016C-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-25 17:49

Reported

2022-10-25 18:00

Platform

win7-20220901-en

Max time kernel

436s

Max time network

440s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe"

Signatures

DiamondFox

botnet stealer diamondfox

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\run C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\\explorer.exe" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1200 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe
PID 1200 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe
PID 1200 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe
PID 1200 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe
PID 1200 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe

"C:\Users\Admin\AppData\Local\Temp\7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f.exe"

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\3F20B41B.cmd

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.microsoft.com udp
NL 104.123.41.162:80 www.microsoft.com tcp
US 8.8.8.8:53 someexampledomain.com udp

Files

memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

memory/1112-59-0x0000000000000000-mapping.dmp

memory/1516-64-0x0000000000000000-mapping.dmp

memory/1200-65-0x0000000000400000-0x000000000041016C-memory.dmp

C:\Users\Admin\AppData\Roaming\lpt9.{2227A280-3AEA-1069-A2DE-08002B30309D}\explorer.exe

MD5 8f77d92060389f5733905710714556ce
SHA1 f817bbd59241f5dd732259784c2fabff78d1dfde
SHA256 7a1833f7b91269b9f0eb48f9bba3db9cc444f749d82255322e1f8e221612895f
SHA512 313e5b16ac7d556a74d19b2610f5e811694c1a660a460604afe5272f416fb1f7f2d04cea173dc9f2ce392e42101225fa0850f03ceaf46616d52347c96097468a

C:\Users\Admin\AppData\Local\Temp\3F20B41B.cmd

MD5 dffedead0c8fecfee445c6a90bef22d6
SHA1 a5611a5df369f47ba3b628ce00aca9d708dd42b7
SHA256 7ae6059d8aae4f75ba06b94dfee957a8a581e0de2b2f3de4c900123f705f1e5b
SHA512 eb2fe35c3b8e2e7fa8d1fd9a806c400ea2483686460495e5e46392311d7ac5ed0d9c4ba3fde4765c64d4e0df9e34cbb3a6237d29eb034e9d1cd11a1b306070fa

memory/1112-68-0x0000000000400000-0x000000000041016C-memory.dmp

memory/1112-69-0x0000000000400000-0x000000000041016C-memory.dmp