diamondfox | 2622cd891ff6151e1c9bb5af31b691c6e91d58d30e2d0446ecd9aabbb0f12d0d

General

Target

53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe
Size

220KB
MD5

b856ee00318bbdbafcc4895350424456
SHA1

e06f26b9f4fe365b85b3ae3b6f0fb4ca3425d98d
SHA256

53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce
SHA512

4a355ccd050e6842eb5baac108e3253ce259a8148b06e0b7e1ed21ae8da0ab396b9241072f4c17501545b33ccfdae7b7f0a881ee2ac4fce6c68fdf48047abec0
SSDEEP

3072:FFlJl9SroIZsF6RBvM+56h2NfF0kz2rx2OZ4tAHTaXZZAfr9QL2Kj8rzvn:rx9EZF1M+ch2hF8rNZOAH+ZAfrK2a83

Score

10^/10

diamondfox botnet evasion persistence spyware stealer trojan

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

xingd.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xingd.exe
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

xingd.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" xingd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xingd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	xingd.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

xingd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xingd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xingd = "C:\\Users\\Admin\\AppData\\Roaming\\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\\xingd.exe"	xingd.exe

Drops startup file 2 IoCs

Processes:

xingd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xingd.exe	xingd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xingd.exe	xingd.exe

Executes dropped EXE 1 IoCs

Processes:

xingd.exe

pid process

4572 xingd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

xingd.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" xingd.exe

pid	process
4572	xingd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	xingd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

xingd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xingd = "C:\\Users\\Admin\\AppData\\Roaming\\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\\xingd.exe"	xingd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xingd = "C:\\Users\\Admin\\AppData\\Roaming\\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\\xingd.exe"	xingd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2404 schtasks.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1296 taskkill.exe
3648 taskkill.exe
4920 taskkill.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1296 taskkill.exe
Token: SeDebugPrivilege 4920 taskkill.exe
Token: SeDebugPrivilege 3648 taskkill.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exexingd.exe

pid process

3080 53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe
4572 xingd.exe

pid	process
2404	schtasks.exe

pid	process
1296	taskkill.exe
3648	taskkill.exe
4920	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe

pid	process
3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe
4572	xingd.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exexingd.exe

description	pid	process	target process
PID 3080 wrote to memory of 4572	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	xingd.exe
PID 3080 wrote to memory of 4572	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	xingd.exe
PID 3080 wrote to memory of 4572	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	xingd.exe
PID 3080 wrote to memory of 4280	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	cmd.exe
PID 3080 wrote to memory of 4280	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	cmd.exe
PID 3080 wrote to memory of 4280	3080	53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe	cmd.exe
PID 4572 wrote to memory of 1296	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 1296	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 1296	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 4920	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 4920	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 4920	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 3648	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 3648	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 3648	4572	xingd.exe	taskkill.exe
PID 4572 wrote to memory of 2404	4572	xingd.exe	schtasks.exe
PID 4572 wrote to memory of 2404	4572	xingd.exe	schtasks.exe
PID 4572 wrote to memory of 2404	4572	xingd.exe	schtasks.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

xingd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xingd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xingd.exe

C:\Users\Admin\AppData\Local\Temp\53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe
"C:\Users\Admin\AppData\Local\Temp\53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Roaming\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\xingd.exe
  C:\Users\Admin\AppData\Roaming\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\xingd.exe
  2⤵
  - UAC bypass
  - Windows security bypass
  - Adds policy Run key to start application
  - Drops startup file
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM wscript.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM firefox.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM chrome.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /tn xingd.exe /tr "C:\Users\Admin\AppData\Roaming\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\xingd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2F2DB8CF.cmd
  2⤵
  PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2F2DB8CF.cmd

Filesize
170B

MD5
3a91a0f7a53a8187461bd6c4936898fa

SHA1
189db2c6fc682cc627a7877f3ec732f19d573287

SHA256
21cf8e9446edd362f11bdc1169f8fb973eacd6fa76fd903db3c8607bdb5c3ac3

SHA512
7b7fda9c61f8148c19b984fa9d67df27919baf7442fb70dea259a0c0c5454760b69856a241ba69417cf710f1fa730c2b76d33d9f7c18fdf7c8b4e63cb2cb3786

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xingd.exe

Filesize
220KB

MD5
b856ee00318bbdbafcc4895350424456

SHA1
e06f26b9f4fe365b85b3ae3b6f0fb4ca3425d98d

SHA256
53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce

SHA512
4a355ccd050e6842eb5baac108e3253ce259a8148b06e0b7e1ed21ae8da0ab396b9241072f4c17501545b33ccfdae7b7f0a881ee2ac4fce6c68fdf48047abec0

Download Submit
C:\Users\Admin\AppData\Roaming\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\xingd.exe

Filesize
220KB

MD5
b856ee00318bbdbafcc4895350424456

SHA1
e06f26b9f4fe365b85b3ae3b6f0fb4ca3425d98d

SHA256
53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce

SHA512
4a355ccd050e6842eb5baac108e3253ce259a8148b06e0b7e1ed21ae8da0ab396b9241072f4c17501545b33ccfdae7b7f0a881ee2ac4fce6c68fdf48047abec0

Download Submit
C:\Users\Admin\AppData\Roaming\com9.{1206F5F1-0569-412C-8FEC-3204630DFB70}\xingd.exe

Filesize
220KB

MD5
b856ee00318bbdbafcc4895350424456

SHA1
e06f26b9f4fe365b85b3ae3b6f0fb4ca3425d98d

SHA256
53b5d0397777ff7b544a1f75739588fe449a2d6d2f4d4f4bb4d51228caa060ce

SHA512
4a355ccd050e6842eb5baac108e3253ce259a8148b06e0b7e1ed21ae8da0ab396b9241072f4c17501545b33ccfdae7b7f0a881ee2ac4fce6c68fdf48047abec0

Download Submit
memory/3080-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3080-6-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/3080-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3080-0-0x0000000002770000-0x0000000002780000-memory.dmp

Filesize
64KB

Download
memory/3080-20-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3080-1-0x00000000022A0000-0x00000000022D9000-memory.dmp

Filesize
228KB

Download
memory/3080-2-0x00000000022A0000-0x00000000022D9000-memory.dmp

Filesize
228KB

Download
memory/4572-13-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/4572-14-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/4572-12-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/4572-29-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads