diamondfox | 51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

General

Target

51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
Size

300KB
MD5

1956f436a6ec9ec3696d8373d36a1228
SHA1

13fde0365047802c39c0d5a29f43075d18823acd
SHA256

51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344
SHA512

c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Score

10^/10

diamondfox botnet discovery stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 5 IoCs

Detects DiamondFox payload in file/memory.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1692-18-0x00000000004466F4-mapping.dmp	WebBrowserPassView
behavioral1/memory/1692-17-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1692-21-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-18-0x00000000004466F4-mapping.dmp	Nirsoft
behavioral1/memory/1692-17-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral1/memory/1692-21-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exe

pid process

1728 MicrosoftEdgeCPS.exe
1692 MicrosoftEdgeCPS.exe

pid	process
1728	MicrosoftEdgeCPS.exe
1692	MicrosoftEdgeCPS.exe

Loads dropped DLL 2 IoCs

Processes:

51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe

pid	process
1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetThreadContext 1 IoCs

Processes:

MicrosoftEdgeCPS.exe

description pid process target process

PID 1728 set thread context of 1692 1728 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exe

pid process

1728 MicrosoftEdgeCPS.exe
1692 MicrosoftEdgeCPS.exe

description	pid	process	target process
PID 1728 set thread context of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe

pid	process
1728	MicrosoftEdgeCPS.exe
1692	MicrosoftEdgeCPS.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	584	wmic.exe
Token: SeSecurityPrivilege	584	wmic.exe
Token: SeTakeOwnershipPrivilege	584	wmic.exe
Token: SeLoadDriverPrivilege	584	wmic.exe
Token: SeSystemProfilePrivilege	584	wmic.exe
Token: SeSystemtimePrivilege	584	wmic.exe
Token: SeProfSingleProcessPrivilege	584	wmic.exe
Token: SeIncBasePriorityPrivilege	584	wmic.exe
Token: SeCreatePagefilePrivilege	584	wmic.exe
Token: SeBackupPrivilege	584	wmic.exe
Token: SeRestorePrivilege	584	wmic.exe
Token: SeShutdownPrivilege	584	wmic.exe
Token: SeDebugPrivilege	584	wmic.exe
Token: SeSystemEnvironmentPrivilege	584	wmic.exe
Token: SeRemoteShutdownPrivilege	584	wmic.exe
Token: SeUndockPrivilege	584	wmic.exe
Token: SeManageVolumePrivilege	584	wmic.exe
Token: 33	584	wmic.exe
Token: 34	584	wmic.exe
Token: 35	584	wmic.exe
Token: SeIncreaseQuotaPrivilege	584	wmic.exe
Token: SeSecurityPrivilege	584	wmic.exe
Token: SeTakeOwnershipPrivilege	584	wmic.exe
Token: SeLoadDriverPrivilege	584	wmic.exe
Token: SeSystemProfilePrivilege	584	wmic.exe
Token: SeSystemtimePrivilege	584	wmic.exe
Token: SeProfSingleProcessPrivilege	584	wmic.exe
Token: SeIncBasePriorityPrivilege	584	wmic.exe
Token: SeCreatePagefilePrivilege	584	wmic.exe
Token: SeBackupPrivilege	584	wmic.exe
Token: SeRestorePrivilege	584	wmic.exe
Token: SeShutdownPrivilege	584	wmic.exe
Token: SeDebugPrivilege	584	wmic.exe
Token: SeSystemEnvironmentPrivilege	584	wmic.exe
Token: SeRemoteShutdownPrivilege	584	wmic.exe
Token: SeUndockPrivilege	584	wmic.exe
Token: SeManageVolumePrivilege	584	wmic.exe
Token: 33	584	wmic.exe
Token: 34	584	wmic.exe
Token: 35	584	wmic.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe
Token: SeSystemProfilePrivilege	1164	wmic.exe
Token: SeSystemtimePrivilege	1164	wmic.exe
Token: SeProfSingleProcessPrivilege	1164	wmic.exe
Token: SeIncBasePriorityPrivilege	1164	wmic.exe
Token: SeCreatePagefilePrivilege	1164	wmic.exe
Token: SeBackupPrivilege	1164	wmic.exe
Token: SeRestorePrivilege	1164	wmic.exe
Token: SeShutdownPrivilege	1164	wmic.exe
Token: SeDebugPrivilege	1164	wmic.exe
Token: SeSystemEnvironmentPrivilege	1164	wmic.exe
Token: SeRemoteShutdownPrivilege	1164	wmic.exe
Token: SeUndockPrivilege	1164	wmic.exe
Token: SeManageVolumePrivilege	1164	wmic.exe
Token: 33	1164	wmic.exe
Token: 34	1164	wmic.exe
Token: 35	1164	wmic.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exeMicrosoftEdgeCPS.exe

description	pid	process	target process
PID 1968 wrote to memory of 1728	1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe	MicrosoftEdgeCPS.exe
PID 1968 wrote to memory of 1728	1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe	MicrosoftEdgeCPS.exe
PID 1968 wrote to memory of 1728	1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe	MicrosoftEdgeCPS.exe
PID 1968 wrote to memory of 1728	1968	51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 584	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 584	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 584	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 584	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1164	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1164	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1164	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1164	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 272	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 272	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 272	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 272	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1716	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1716	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1716	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1716	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1100	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1100	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1100	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1100	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 968	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 968	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 968	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 968	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 892	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 892	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 892	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 892	1728	MicrosoftEdgeCPS.exe	wmic.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe
PID 1728 wrote to memory of 1692	1728	MicrosoftEdgeCPS.exe	MicrosoftEdgeCPS.exe

C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
"C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get caption /FORMAT:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_VideoController get caption /FORMAT:List
3⤵
PID:272

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List
3⤵
PID:1716

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List
3⤵
PID:1100

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_PingStatus where address='outarcubleauded.xyz' get StatusCode /FORMAT:List
3⤵
PID:968

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_PingStatus where address='outarcubleauded.xyz' get ResponseTime /FORMAT:List
3⤵
PID:892

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
MD5
1956f436a6ec9ec3696d8373d36a1228

SHA1
13fde0365047802c39c0d5a29f43075d18823acd

SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
MD5
1956f436a6ec9ec3696d8373d36a1228

SHA1
13fde0365047802c39c0d5a29f43075d18823acd

SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
MD5
1956f436a6ec9ec3696d8373d36a1228

SHA1
13fde0365047802c39c0d5a29f43075d18823acd

SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Download Submit
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
MD5
1956f436a6ec9ec3696d8373d36a1228

SHA1
13fde0365047802c39c0d5a29f43075d18823acd

SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Download Submit
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
MD5
1956f436a6ec9ec3696d8373d36a1228

SHA1
13fde0365047802c39c0d5a29f43075d18823acd

SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Download Submit
memory/272-12-0x0000000000000000-mapping.dmp

Download
memory/584-10-0x0000000000000000-mapping.dmp

Download
memory/756-8-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

Filesize
2.5MB

Download
memory/892-16-0x0000000000000000-mapping.dmp

Download
memory/968-15-0x0000000000000000-mapping.dmp

Download
memory/1100-14-0x0000000000000000-mapping.dmp

Download
memory/1164-11-0x0000000000000000-mapping.dmp

Download
memory/1692-18-0x00000000004466F4-mapping.dmp

Download
memory/1692-17-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1692-21-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1716-13-0x0000000000000000-mapping.dmp

Download
memory/1728-5-0x0000000000000000-mapping.dmp

Download
memory/1968-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads