diamondfox | be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f

Analysis

max time kernel
146s
max time network
129s
platform
windows7_x64
resource
win7-en-20211208
submitted
08-03-2022 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
Size

304KB
MD5

5a44c99ad691038006c6ed68f3cdbf7e
SHA1

f120f9ac21d278bcee07f288c56da69b7a38d4bf
SHA256

be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f
SHA512

14e8cb45e7fff8fd9ddad8b92645702faa64781521d428f636ad9c492889dc799862a028185ceed1426f8254bfe6e671b3dd5a826dc4afc92b7b559f89c1a8cc

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 3 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral1/memory/536-70-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox
behavioral1/memory/536-73-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox
behavioral1/memory/1736-101-0x0000000000400000-0x0000000000436000-memory.dmp	diamondfox

Executes dropped EXE 3 IoCs

pid	Process
336	MicrosoftEdgeCPS.exe
1736	MicrosoftEdgeCPS.exe
1300	MicrosoftEdgeCPS.exe

Loads dropped DLL 2 IoCs

pid	Process
536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
336	MicrosoftEdgeCPS.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 336 set thread context of 1736	336	MicrosoftEdgeCPS.exe	33

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
1988	powershell.exe
336	MicrosoftEdgeCPS.exe
336	MicrosoftEdgeCPS.exe
1096	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	336	MicrosoftEdgeCPS.exe
Token: SeDebugPrivilege	1096	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 1676 wrote to memory of 536	1676	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	27
PID 536 wrote to memory of 336	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	30
PID 536 wrote to memory of 336	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	30
PID 536 wrote to memory of 336	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	30
PID 536 wrote to memory of 336	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	30
PID 536 wrote to memory of 1988	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	31
PID 536 wrote to memory of 1988	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	31
PID 536 wrote to memory of 1988	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	31
PID 536 wrote to memory of 1988	536	be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe	31
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 336 wrote to memory of 1736	336	MicrosoftEdgeCPS.exe	33
PID 1736 wrote to memory of 1300	1736	MicrosoftEdgeCPS.exe	34
PID 1736 wrote to memory of 1300	1736	MicrosoftEdgeCPS.exe	34
PID 1736 wrote to memory of 1300	1736	MicrosoftEdgeCPS.exe	34
PID 1736 wrote to memory of 1300	1736	MicrosoftEdgeCPS.exe	34
PID 1736 wrote to memory of 1096	1736	MicrosoftEdgeCPS.exe	35
PID 1736 wrote to memory of 1096	1736	MicrosoftEdgeCPS.exe	35
PID 1736 wrote to memory of 1096	1736	MicrosoftEdgeCPS.exe	35
PID 1736 wrote to memory of 1096	1736	MicrosoftEdgeCPS.exe	35

C:\Users\Admin\AppData\Local\Temp\be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
"C:\Users\Admin\AppData\Local\Temp\be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
  C:\Users\Admin\AppData\Local\Temp\be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
    "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
        
        "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
        5⤵
        Executes dropped EXE
        
        PID:1300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeCPS.exe' -Force -Recurse
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\be9b864a9cb2256b2c1b09543bd047023c53b915a26e85d16b5f987c1163ae8f.exe' -Force -Recurse
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-78-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/336-77-0x0000000000EF0000-0x0000000000F42000-memory.dmp

Filesize
328KB

Download
memory/336-79-0x0000000004710000-0x0000000004711000-memory.dmp

Filesize
4KB

Download
memory/536-62-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-68-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-60-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-70-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-73-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-72-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/536-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-66-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1096-111-0x00000000024D0000-0x000000000311A000-memory.dmp

Filesize
12.3MB

Download
memory/1096-110-0x00000000714B0000-0x0000000071A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1096-113-0x00000000024D0000-0x000000000311A000-memory.dmp

Filesize
12.3MB

Download
memory/1096-112-0x00000000024D0000-0x000000000311A000-memory.dmp

Filesize
12.3MB

Download
memory/1300-107-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/1300-108-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/1300-105-0x0000000000C10000-0x0000000000C62000-memory.dmp

Filesize
328KB

Download
memory/1676-56-0x0000000000CE0000-0x0000000000D32000-memory.dmp

Filesize
328KB

Download
memory/1676-58-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/1676-59-0x00000000008C0000-0x00000000008DC000-memory.dmp

Filesize
112KB

Download
memory/1676-57-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1676-55-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/1736-101-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1988-85-0x0000000002412000-0x0000000002414000-memory.dmp

Filesize
8KB

Download
memory/1988-84-0x0000000002411000-0x0000000002412000-memory.dmp

Filesize
4KB

Download
memory/1988-83-0x00000000714B0000-0x0000000071A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-82-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1988-81-0x00000000714B0000-0x0000000071A5B000-memory.dmp

Filesize
5.7MB

Download