diamondfox | 9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f

Analysis

max time kernel
134s
max time network
56s
platform
windows10_x64
resource
win10v20210408
submitted
29/05/2021, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
Size

459KB
MD5

195eecffa8cb3f26eb11eb4aa379eaf6
SHA1

88feb6f6d975581a680e07bd9f421167b6a852d1
SHA256

9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f
SHA512

03b41c14b68990bead4a75fa35682b7c48ee97fb31d05d2f678d59826b66ea3b1211fb7ee3bffb0ba9c2ffe514ee78503674db25a49726717c160f3bc3b21f8a

Score

10^/10

diamondfox botnet stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 5 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral2/memory/3756-126-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox
behavioral2/memory/3756-127-0x0000000000401000-mapping.dmp	diamondfox
behavioral2/memory/3756-128-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox
behavioral2/memory/4040-178-0x0000000000401000-mapping.dmp	diamondfox
behavioral2/memory/4040-180-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox

Executes dropped EXE 4 IoCs

pid	Process
1388	MicrosoftEdgeCPS.exe
3772	MicrosoftEdgeCPS.exe
4040	MicrosoftEdgeCPS.exe
3176	MicrosoftEdgeCPS.exe

Deletes itself 1 IoCs

pid	Process
1540	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 1388 set thread context of 4040	1388	MicrosoftEdgeCPS.exe	85

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1388	MicrosoftEdgeCPS.exe
1388	MicrosoftEdgeCPS.exe
1388	MicrosoftEdgeCPS.exe
1388	MicrosoftEdgeCPS.exe
1388	MicrosoftEdgeCPS.exe
1388	MicrosoftEdgeCPS.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1388	MicrosoftEdgeCPS.exe
Token: SeDebugPrivilege	2228	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 304	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	78
PID 804 wrote to memory of 304	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	78
PID 804 wrote to memory of 304	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	78
PID 804 wrote to memory of 96	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	79
PID 804 wrote to memory of 96	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	79
PID 804 wrote to memory of 96	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	79
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 804 wrote to memory of 3756	804	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	80
PID 3756 wrote to memory of 1388	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	81
PID 3756 wrote to memory of 1388	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	81
PID 3756 wrote to memory of 1388	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	81
PID 3756 wrote to memory of 1540	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	82
PID 3756 wrote to memory of 1540	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	82
PID 3756 wrote to memory of 1540	3756	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe	82
PID 1388 wrote to memory of 3772	1388	MicrosoftEdgeCPS.exe	84
PID 1388 wrote to memory of 3772	1388	MicrosoftEdgeCPS.exe	84
PID 1388 wrote to memory of 3772	1388	MicrosoftEdgeCPS.exe	84
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 1388 wrote to memory of 4040	1388	MicrosoftEdgeCPS.exe	85
PID 4040 wrote to memory of 3176	4040	MicrosoftEdgeCPS.exe	86
PID 4040 wrote to memory of 3176	4040	MicrosoftEdgeCPS.exe	86
PID 4040 wrote to memory of 3176	4040	MicrosoftEdgeCPS.exe	86
PID 4040 wrote to memory of 2228	4040	MicrosoftEdgeCPS.exe	87
PID 4040 wrote to memory of 2228	4040	MicrosoftEdgeCPS.exe	87
PID 4040 wrote to memory of 2228	4040	MicrosoftEdgeCPS.exe	87

C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
"C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  2⤵
  PID:304
- C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  2⤵
  PID:96
- C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
    "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      4⤵
      Executes dropped EXE
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
        5⤵
        Executes dropped EXE
        
        PID:3176
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe' -Force -Recurse
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f.exe' -Force -Recurse
    3⤵
    - Deletes itself
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-116-0x0000000005C90000-0x0000000005C91000-memory.dmp

Filesize
4KB

Download
memory/804-117-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/804-114-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/804-118-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/804-119-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/804-120-0x0000000005950000-0x0000000005954000-memory.dmp

Filesize
16KB

Download
memory/804-125-0x0000000007190000-0x00000000071A7000-memory.dmp

Filesize
92KB

Download
memory/1388-142-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1540-143-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/1540-153-0x00000000083F0000-0x00000000083F1000-memory.dmp

Filesize
4KB

Download
memory/1540-154-0x00000000081D0000-0x00000000081D1000-memory.dmp

Filesize
4KB

Download
memory/1540-155-0x0000000008800000-0x0000000008801000-memory.dmp

Filesize
4KB

Download
memory/1540-156-0x0000000008B10000-0x0000000008B11000-memory.dmp

Filesize
4KB

Download
memory/1540-161-0x000000000A020000-0x000000000A021000-memory.dmp

Filesize
4KB

Download
memory/1540-162-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/1540-167-0x0000000009BA0000-0x0000000009BA1000-memory.dmp

Filesize
4KB

Download
memory/1540-168-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/1540-173-0x0000000007433000-0x0000000007434000-memory.dmp

Filesize
4KB

Download
memory/1540-151-0x00000000081F0000-0x00000000081F1000-memory.dmp

Filesize
4KB

Download
memory/1540-150-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/1540-152-0x0000000008110000-0x0000000008111000-memory.dmp

Filesize
4KB

Download
memory/1540-140-0x00000000072F0000-0x00000000072F1000-memory.dmp

Filesize
4KB

Download
memory/1540-141-0x0000000007A70000-0x0000000007A71000-memory.dmp

Filesize
4KB

Download
memory/1540-145-0x0000000007432000-0x0000000007433000-memory.dmp

Filesize
4KB

Download
memory/2228-201-0x0000000006CA0000-0x0000000006CA1000-memory.dmp

Filesize
4KB

Download
memory/2228-202-0x0000000006CA2000-0x0000000006CA3000-memory.dmp

Filesize
4KB

Download
memory/2228-205-0x0000000006CA3000-0x0000000006CA4000-memory.dmp

Filesize
4KB

Download
memory/3176-199-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/3756-126-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3756-128-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4040-180-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download