Analysis
-
max time kernel
53s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-02-2023 23:20
Behavioral task
behavioral1
Sample
Diavlo v2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Diavlo v2.exe
Resource
win10v2004-20220901-en
General
-
Target
Diavlo v2.exe
-
Size
37.6MB
-
MD5
f546ad3c58cf8067f72ab2cc7ab07997
-
SHA1
35a8ea8434ea2eda229b10a8266833cbd1227be5
-
SHA256
82dffd73e3dbbd3f3333aa68fff3d8b1ac02090f79cd8fd46663515321507291
-
SHA512
bf41d5c68f6c0875dbdd2100dd50367440e7172e698f2622f9a9aca8a08c9ca388ca863f0ff3a8b10197673f524aa25818ad21469e8016fb6ba126861da82dd4
-
SSDEEP
393216:uT+UwRM9dM/ISGL2Vmd6ml/m3p5c/eEJ4PV4aU55RdG1xSNiQ:/qT6ISGyVmdXK5uh4PqrG14NiQ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Diavlo v2.exepid process 1788 Diavlo v2.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
chrome.exechrome.exepid process 896 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exepid process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Diavlo v2.exechrome.exedescription pid process target process PID 2044 wrote to memory of 1788 2044 Diavlo v2.exe Diavlo v2.exe PID 2044 wrote to memory of 1788 2044 Diavlo v2.exe Diavlo v2.exe PID 2044 wrote to memory of 1788 2044 Diavlo v2.exe Diavlo v2.exe PID 2016 wrote to memory of 628 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 628 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 628 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 608 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 896 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 896 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 896 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 376 2016 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Diavlo v2.exe"C:\Users\Admin\AppData\Local\Temp\Diavlo v2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\Diavlo v2.exe"C:\Users\Admin\AppData\Local\Temp\Diavlo v2.exe"2⤵
- Loads dropped DLL
PID:1788
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70a4f50,0x7fef70a4f60,0x7fef70a4f702⤵PID:628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:22⤵PID:608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:896 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:82⤵PID:376
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:12⤵PID:1072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:12⤵PID:1744
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:82⤵PID:1384
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2652 /prefetch:22⤵PID:1672
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:864
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3448 /prefetch:82⤵PID:1980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,7107972283544102982,14588979055153892590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:82⤵PID:2056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI20442\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
\??\pipe\crashpad_2016_YFHBZQZOSYYKZFVKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\_MEI20442\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
memory/1788-54-0x0000000000000000-mapping.dmp