Analysis Overview
SHA256
0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
Threat Level: Known bad
The file new.exe was found to be: Known bad.
Malicious Activity Summary
DiamondFox payload
Diamondfox family
DiamondFox
DiamondFox payload
Executes dropped EXE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2022-05-12 15:07
Signatures
DiamondFox payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Diamondfox family
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-12 15:07
Reported
2022-05-12 15:11
Platform
win10v2004-20220414-en
Max time kernel
190s
Max time network
200s
Command Line
Signatures
DiamondFox
DiamondFox payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4264 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\new.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 4264 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\new.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 4264 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\new.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 4804 wrote to memory of 4920 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 4804 wrote to memory of 4920 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 4804 wrote to memory of 4920 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
Network
| Country | Destination | Domain | Proto |
| US | 67.26.205.254:80 | tcp | |
| US | 67.26.205.254:80 | tcp | |
| US | 20.42.65.88:443 | tcp | |
| US | 67.26.205.254:80 | tcp | |
| US | 67.26.205.254:80 | tcp | |
| US | 67.26.205.254:80 | tcp | |
| US | 8.8.8.8:53 | acachipalletdiamond.ac | udp |
Files
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
| MD5 | d0adc891c2d75a5750a0762418fa0f23 |
| SHA1 | bfbbc833f3f85d693139b43002181fab5ff8da1d |
| SHA256 | 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51 |
| SHA512 | 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f |
memory/4920-134-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
| MD5 | d0adc891c2d75a5750a0762418fa0f23 |
| SHA1 | bfbbc833f3f85d693139b43002181fab5ff8da1d |
| SHA256 | 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51 |
| SHA512 | 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f |
memory/4804-131-0x0000000000000000-mapping.dmp
memory/4920-135-0x00000000023F0000-0x0000000002426000-memory.dmp
memory/4920-136-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/4920-137-0x0000000004E70000-0x0000000004E92000-memory.dmp
memory/4920-138-0x0000000005540000-0x00000000055A6000-memory.dmp
memory/4920-139-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/4920-140-0x0000000005D20000-0x0000000005D3E000-memory.dmp
memory/4920-142-0x00000000741A0000-0x00000000741EC000-memory.dmp
memory/4920-141-0x0000000006EE0000-0x0000000006F12000-memory.dmp
memory/4920-143-0x00000000062D0000-0x00000000062EE000-memory.dmp
memory/4920-144-0x0000000007660000-0x0000000007CDA000-memory.dmp
memory/4920-145-0x0000000006000000-0x000000000601A000-memory.dmp
memory/4920-146-0x00000000070A0000-0x00000000070AA000-memory.dmp
memory/4920-147-0x00000000072B0000-0x0000000007346000-memory.dmp
memory/4920-148-0x0000000007020000-0x000000000702E000-memory.dmp
memory/4920-149-0x0000000004EA0000-0x0000000004EBA000-memory.dmp
memory/4920-150-0x0000000000690000-0x0000000000698000-memory.dmp