diamondfox | ee43e21fbfb66eba6ef729b0f660f8b9110c8b2d22fa8c34de4a57cb38d70f86

General

Target

new.exe
Size

204KB
MD5

8a40b88f514ef21f74052d22e2d98750
SHA1

524e636f22bb8a5c2f7947727d5f91dd3dd05972
SHA256

ee43e21fbfb66eba6ef729b0f660f8b9110c8b2d22fa8c34de4a57cb38d70f86
SHA512

cfb5416c676a84fdc291a548222650701d62832100cd5d08fb480b585ea1e76a4b2dc4b181e3ae2916a2b91a6ab09bc6178aec4d2c023396fb596d17b80cc215

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral1/memory/3864-130-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox
behavioral1/files/0x000500000001e7cd-132.dat	diamondfox
behavioral1/files/0x000500000001e7cd-133.dat	diamondfox
behavioral1/memory/1364-137-0x0000000000400000-0x0000000000437000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

pid	Process
1364	MicrosoftEdgeCPS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1364	3864	new.exe	83
PID 3864 wrote to memory of 1364	3864	new.exe	83
PID 3864 wrote to memory of 1364	3864	new.exe	83
PID 1364 wrote to memory of 1568	1364	MicrosoftEdgeCPS.exe	84
PID 1364 wrote to memory of 1568	1364	MicrosoftEdgeCPS.exe	84
PID 1364 wrote to memory of 1568	1364	MicrosoftEdgeCPS.exe	84

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
204KB

MD5
8a40b88f514ef21f74052d22e2d98750

SHA1
524e636f22bb8a5c2f7947727d5f91dd3dd05972

SHA256
ee43e21fbfb66eba6ef729b0f660f8b9110c8b2d22fa8c34de4a57cb38d70f86

SHA512
cfb5416c676a84fdc291a548222650701d62832100cd5d08fb480b585ea1e76a4b2dc4b181e3ae2916a2b91a6ab09bc6178aec4d2c023396fb596d17b80cc215

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
204KB

MD5
8a40b88f514ef21f74052d22e2d98750

SHA1
524e636f22bb8a5c2f7947727d5f91dd3dd05972

SHA256
ee43e21fbfb66eba6ef729b0f660f8b9110c8b2d22fa8c34de4a57cb38d70f86

SHA512
cfb5416c676a84fdc291a548222650701d62832100cd5d08fb480b585ea1e76a4b2dc4b181e3ae2916a2b91a6ab09bc6178aec4d2c023396fb596d17b80cc215

Download Submit
memory/1364-137-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1568-140-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/1568-143-0x00000000061B0000-0x00000000061E2000-memory.dmp

Filesize
200KB

Download
memory/1568-136-0x0000000004CB0000-0x00000000052D8000-memory.dmp

Filesize
6.2MB

Download
memory/1568-138-0x0000000004C10000-0x0000000004C32000-memory.dmp

Filesize
136KB

Download
memory/1568-139-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/1568-152-0x0000000007170000-0x0000000007178000-memory.dmp

Filesize
32KB

Download
memory/1568-141-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

Filesize
120KB

Download
memory/1568-142-0x00000000009B0000-0x00000000009C0000-memory.dmp

Filesize
64KB

Download
memory/1568-135-0x0000000004640000-0x0000000004676000-memory.dmp

Filesize
216KB

Download
memory/1568-144-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Filesize
304KB

Download
memory/1568-145-0x0000000004920000-0x000000000493E000-memory.dmp

Filesize
120KB

Download
memory/1568-146-0x0000000007540000-0x0000000007BBA000-memory.dmp

Filesize
6.5MB

Download
memory/1568-147-0x0000000006E80000-0x0000000006E9A000-memory.dmp

Filesize
104KB

Download
memory/1568-148-0x0000000006F60000-0x0000000006F6A000-memory.dmp

Filesize
40KB

Download
memory/1568-149-0x0000000007190000-0x0000000007226000-memory.dmp

Filesize
600KB

Download
memory/1568-150-0x0000000007130000-0x000000000713E000-memory.dmp

Filesize
56KB

Download
memory/1568-151-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/3864-130-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing