Overview

overview

10

Static

static

10

51c2ff5ec0...in.exe

windows7_x64

10

51c2ff5ec0...in.exe

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    06/04/2021, 13:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.bin.exe

  • Size

    300KB

  • MD5

    1956f436a6ec9ec3696d8373d36a1228

  • SHA1

    13fde0365047802c39c0d5a29f43075d18823acd

  • SHA256

    51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344

  • SHA512

    c064d4d66757446e023fbfceb20f63c51398c41922fb85e64329b0c7f7fab2c4703a852e77dbf6903edb52f3b460f915e7c888037ebad68e80e1187347406120

Score
10/10
diamondfoxbotnetstealer

Malware Config

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox
  • DiamondFox payload 3 IoCs

    Detects DiamondFox payload in file/memory.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344.bin.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
      "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
      2⤵
      • Executes dropped EXE
      PID:1188

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1320-8-0x000007FEF7160000-0x000007FEF73DA000-memory.dmp

          Filesize

          2.5MB

          Download

        • memory/1752-2-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

          Filesize

          8KB

          Download