diamondfox | d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a

General

Target

new.exe
Size

204KB
MD5

83ad1aef29c044fc8a630711be34b420
SHA1

dda0ae0fe60b1322aa99151472d1d98518238be9
SHA256

d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a
SHA512

e6951c48e00fb41cae729240c7829cad268627f141ba22178a8d2d6b717bb387d6b7723f03b575f0b596e77466ddd7ab83be284e78e2588edc8f1981cf543383

Score

10^/10

diamondfox botnet infostealer stealer suricata

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/368-130-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	diamondfox
behavioral2/memory/1356-135-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

Processes:

MicrosoftEdgeCPS.exe

pid process

1356 MicrosoftEdgeCPS.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1640 powershell.exe
1640 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1640 powershell.exe

pid	process
1356	MicrosoftEdgeCPS.exe

pid	process
1640	powershell.exe
1640	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1640	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

new.exeMicrosoftEdgeCPS.exe

description	pid	process	target process
PID 368 wrote to memory of 1356	368	new.exe	MicrosoftEdgeCPS.exe
PID 368 wrote to memory of 1356	368	new.exe	MicrosoftEdgeCPS.exe
PID 368 wrote to memory of 1356	368	new.exe	MicrosoftEdgeCPS.exe
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	powershell.exe
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	powershell.exe
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5
83ad1aef29c044fc8a630711be34b420

SHA1
dda0ae0fe60b1322aa99151472d1d98518238be9

SHA256
d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a

SHA512
e6951c48e00fb41cae729240c7829cad268627f141ba22178a8d2d6b717bb387d6b7723f03b575f0b596e77466ddd7ab83be284e78e2588edc8f1981cf543383

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5
83ad1aef29c044fc8a630711be34b420

SHA1
dda0ae0fe60b1322aa99151472d1d98518238be9

SHA256
d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a

SHA512
e6951c48e00fb41cae729240c7829cad268627f141ba22178a8d2d6b717bb387d6b7723f03b575f0b596e77466ddd7ab83be284e78e2588edc8f1981cf543383

Download Submit
memory/368-130-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1356-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1356-131-0x0000000000000000-mapping.dmp

Download
memory/1640-140-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/1640-144-0x0000000070300000-0x000000007034C000-memory.dmp

Filesize
304KB

Download
memory/1640-137-0x0000000005420000-0x0000000005A48000-memory.dmp

Filesize
6.2MB

Download
memory/1640-138-0x0000000005180000-0x00000000051A2000-memory.dmp

Filesize
136KB

Download
memory/1640-139-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/1640-134-0x0000000000000000-mapping.dmp

Download
memory/1640-141-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/1640-142-0x0000000004DE5000-0x0000000004DE7000-memory.dmp

Filesize
8KB

Download
memory/1640-143-0x00000000070F0000-0x0000000007122000-memory.dmp

Filesize
200KB

Download
memory/1640-136-0x0000000002810000-0x0000000002846000-memory.dmp

Filesize
216KB

Download
memory/1640-145-0x00000000070B0000-0x00000000070CE000-memory.dmp

Filesize
120KB

Download
memory/1640-146-0x0000000007B00000-0x000000000817A000-memory.dmp

Filesize
6.5MB

Download
memory/1640-147-0x00000000074B0000-0x00000000074CA000-memory.dmp

Filesize
104KB

Download
memory/1640-148-0x0000000007520000-0x000000000752A000-memory.dmp

Filesize
40KB

Download
memory/1640-149-0x0000000007730000-0x00000000077C6000-memory.dmp

Filesize
600KB

Download
memory/1640-150-0x00000000076F0000-0x00000000076FE000-memory.dmp

Filesize
56KB

Download
memory/1640-151-0x0000000007800000-0x000000000781A000-memory.dmp

Filesize
104KB

Download
memory/1640-152-0x00000000077E0000-0x00000000077E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads