diamondfox | d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a

General

Target

new.exe
Size

204KB
MD5

83ad1aef29c044fc8a630711be34b420
SHA1

dda0ae0fe60b1322aa99151472d1d98518238be9
SHA256

d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a
SHA512

e6951c48e00fb41cae729240c7829cad268627f141ba22178a8d2d6b717bb387d6b7723f03b575f0b596e77466ddd7ab83be284e78e2588edc8f1981cf543383

Score

10^/10

diamondfox botnet infostealer stealer suricata

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral2/memory/368-130-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox
behavioral2/files/0x000400000001e7e8-132.dat	diamondfox
behavioral2/files/0x000400000001e7e8-133.dat	diamondfox
behavioral2/memory/1356-135-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

pid	Process
1356	MicrosoftEdgeCPS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	powershell.exe
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1356	368	new.exe	79
PID 368 wrote to memory of 1356	368	new.exe	79
PID 368 wrote to memory of 1356	368	new.exe	79
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	80
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	80
PID 1356 wrote to memory of 1640	1356	MicrosoftEdgeCPS.exe	80

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-130-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1356-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1640-140-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/1640-144-0x0000000070300000-0x000000007034C000-memory.dmp

Filesize
304KB

Download
memory/1640-137-0x0000000005420000-0x0000000005A48000-memory.dmp

Filesize
6.2MB

Download
memory/1640-138-0x0000000005180000-0x00000000051A2000-memory.dmp

Filesize
136KB

Download
memory/1640-139-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/1640-141-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/1640-142-0x0000000004DE5000-0x0000000004DE7000-memory.dmp

Filesize
8KB

Download
memory/1640-143-0x00000000070F0000-0x0000000007122000-memory.dmp

Filesize
200KB

Download
memory/1640-136-0x0000000002810000-0x0000000002846000-memory.dmp

Filesize
216KB

Download
memory/1640-145-0x00000000070B0000-0x00000000070CE000-memory.dmp

Filesize
120KB

Download
memory/1640-146-0x0000000007B00000-0x000000000817A000-memory.dmp

Filesize
6.5MB

Download
memory/1640-147-0x00000000074B0000-0x00000000074CA000-memory.dmp

Filesize
104KB

Download
memory/1640-148-0x0000000007520000-0x000000000752A000-memory.dmp

Filesize
40KB

Download
memory/1640-149-0x0000000007730000-0x00000000077C6000-memory.dmp

Filesize
600KB

Download
memory/1640-150-0x00000000076F0000-0x00000000076FE000-memory.dmp

Filesize
56KB

Download
memory/1640-151-0x0000000007800000-0x000000000781A000-memory.dmp

Filesize
104KB

Download
memory/1640-152-0x00000000077E0000-0x00000000077E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing