Analysis
-
max time kernel
121s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
28-11-2023 22:01
General
-
Target
Setup Audiolens v1.2.0.exe
-
Size
393.0MB
-
MD5
352aab786d3b494caab56cccef691058
-
SHA1
f091676fb82583eb779f9c9d11d3ab97aa64b509
-
SHA256
f7695730f1e5eaeaace310617f7c4174f63af6651fcce1de6572e19340df93d9
-
SHA512
55ac7b48dee59fb6d7b91060f7eee72bef3a5d246297fe04b172aa49dcefd0a7b18ede77361bbcc8899428b796cd87577f611517becc99bcdab72a1f5dc7ebc8
-
SSDEEP
12582912:5k0n3GZbJ9CkdaR/+znK/g8EVk6qSHMHvvw1zRcKMeeHkVshmWubL:KuYbJ97aMTK/gNVTqCMnyuP7HkV3tL
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 1 IoCs
Detects DiamondFox payload in file/memory.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup Audiolens v1.2.0.exe"C:\Users\Admin\AppData\Local\Temp\Setup Audiolens v1.2.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EISH0.tmp\Setup Audiolens v1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-EISH0.tmp\Setup Audiolens v1.2.0.tmp" /SL5="$5022C,411638018,121344,C:\Users\Admin\AppData\Local\Temp\Setup Audiolens v1.2.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
391.3MB
MD5618bd706bf213a70606793b5c7687d70
SHA1c27840fa404cbde3becee97968276dbd6edab63b
SHA256255003eaf2613e74e739b6b69290daae01f56e5a8f76fdb5336bcb18112f01da
SHA512576efe6759d12e43a1bda5172d223e3056afdfb165a5c77978803942ca77305fb9a81d1698589543f2c65e50790f5aab6bd198d3b949d883017f02ac0c22860b
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
700KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
192KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
464KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
880KB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
5.7MB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
908KB
-
Filesize
1.1MB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
880KB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB