Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13/02/2021, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe
-
Size
300KB
-
MD5
1956f436a6ec9ec3696d8373d36a1228
-
SHA1
13fde0365047802c39c0d5a29f43075d18823acd
-
SHA256
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344
-
SHA512
c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120
Score
10/10
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 4 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral2/files/0x000200000001ab9f-3.dat diamondfox behavioral2/files/0x000200000001ab9f-4.dat diamondfox behavioral2/files/0x000200000001ab9f-14.dat diamondfox behavioral2/files/0x000200000001ab9f-19.dat diamondfox -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3548-12-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView behavioral2/memory/3548-13-0x00000000004466F4-mapping.dmp WebBrowserPassView behavioral2/memory/3548-15-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral2/memory/3548-12-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral2/memory/3548-13-0x00000000004466F4-mapping.dmp Nirsoft behavioral2/memory/3548-15-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
pid Process 420 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe 3824 MicrosoftEdgeCPS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 420 set thread context of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 set thread context of 3824 420 MicrosoftEdgeCPS.exe 96 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 420 MicrosoftEdgeCPS.exe 420 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1944 wmic.exe Token: SeSecurityPrivilege 1944 wmic.exe Token: SeTakeOwnershipPrivilege 1944 wmic.exe Token: SeLoadDriverPrivilege 1944 wmic.exe Token: SeSystemProfilePrivilege 1944 wmic.exe Token: SeSystemtimePrivilege 1944 wmic.exe Token: SeProfSingleProcessPrivilege 1944 wmic.exe Token: SeIncBasePriorityPrivilege 1944 wmic.exe Token: SeCreatePagefilePrivilege 1944 wmic.exe Token: SeBackupPrivilege 1944 wmic.exe Token: SeRestorePrivilege 1944 wmic.exe Token: SeShutdownPrivilege 1944 wmic.exe Token: SeDebugPrivilege 1944 wmic.exe Token: SeSystemEnvironmentPrivilege 1944 wmic.exe Token: SeRemoteShutdownPrivilege 1944 wmic.exe Token: SeUndockPrivilege 1944 wmic.exe Token: SeManageVolumePrivilege 1944 wmic.exe Token: 33 1944 wmic.exe Token: 34 1944 wmic.exe Token: 35 1944 wmic.exe Token: 36 1944 wmic.exe Token: SeIncreaseQuotaPrivilege 1944 wmic.exe Token: SeSecurityPrivilege 1944 wmic.exe Token: SeTakeOwnershipPrivilege 1944 wmic.exe Token: SeLoadDriverPrivilege 1944 wmic.exe Token: SeSystemProfilePrivilege 1944 wmic.exe Token: SeSystemtimePrivilege 1944 wmic.exe Token: SeProfSingleProcessPrivilege 1944 wmic.exe Token: SeIncBasePriorityPrivilege 1944 wmic.exe Token: SeCreatePagefilePrivilege 1944 wmic.exe Token: SeBackupPrivilege 1944 wmic.exe Token: SeRestorePrivilege 1944 wmic.exe Token: SeShutdownPrivilege 1944 wmic.exe Token: SeDebugPrivilege 1944 wmic.exe Token: SeSystemEnvironmentPrivilege 1944 wmic.exe Token: SeRemoteShutdownPrivilege 1944 wmic.exe Token: SeUndockPrivilege 1944 wmic.exe Token: SeManageVolumePrivilege 1944 wmic.exe Token: 33 1944 wmic.exe Token: 34 1944 wmic.exe Token: 35 1944 wmic.exe Token: 36 1944 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: 36 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3824 MicrosoftEdgeCPS.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 644 wrote to memory of 420 644 51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe 77 PID 644 wrote to memory of 420 644 51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe 77 PID 644 wrote to memory of 420 644 51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe 77 PID 420 wrote to memory of 1944 420 MicrosoftEdgeCPS.exe 79 PID 420 wrote to memory of 1944 420 MicrosoftEdgeCPS.exe 79 PID 420 wrote to memory of 1944 420 MicrosoftEdgeCPS.exe 79 PID 420 wrote to memory of 2720 420 MicrosoftEdgeCPS.exe 81 PID 420 wrote to memory of 2720 420 MicrosoftEdgeCPS.exe 81 PID 420 wrote to memory of 2720 420 MicrosoftEdgeCPS.exe 81 PID 420 wrote to memory of 3704 420 MicrosoftEdgeCPS.exe 84 PID 420 wrote to memory of 3704 420 MicrosoftEdgeCPS.exe 84 PID 420 wrote to memory of 3704 420 MicrosoftEdgeCPS.exe 84 PID 420 wrote to memory of 3844 420 MicrosoftEdgeCPS.exe 86 PID 420 wrote to memory of 3844 420 MicrosoftEdgeCPS.exe 86 PID 420 wrote to memory of 3844 420 MicrosoftEdgeCPS.exe 86 PID 420 wrote to memory of 3356 420 MicrosoftEdgeCPS.exe 88 PID 420 wrote to memory of 3356 420 MicrosoftEdgeCPS.exe 88 PID 420 wrote to memory of 3356 420 MicrosoftEdgeCPS.exe 88 PID 420 wrote to memory of 4052 420 MicrosoftEdgeCPS.exe 90 PID 420 wrote to memory of 4052 420 MicrosoftEdgeCPS.exe 90 PID 420 wrote to memory of 4052 420 MicrosoftEdgeCPS.exe 90 PID 420 wrote to memory of 1012 420 MicrosoftEdgeCPS.exe 92 PID 420 wrote to memory of 1012 420 MicrosoftEdgeCPS.exe 92 PID 420 wrote to memory of 1012 420 MicrosoftEdgeCPS.exe 92 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3548 420 MicrosoftEdgeCPS.exe 95 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96 PID 420 wrote to memory of 3824 420 MicrosoftEdgeCPS.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe"C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" os get caption /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get caption /FORMAT:List3⤵PID:3704
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List3⤵PID:3844
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List3⤵PID:3356
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='outarcubleauded.xyz' get StatusCode /FORMAT:List3⤵PID:4052
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='outarcubleauded.xyz' get ResponseTime /FORMAT:List3⤵PID:1012
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\4.log"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3824
-
-