Malware Analysis Report

2024-07-11 07:31

Sample ID 220512-shkebsheb8
Target new.exe
SHA256 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
Tags
infostealer diamondfox botnet stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51

Threat Level: Known bad

The file new.exe was found to be: Known bad.

Malicious Activity Summary

infostealer diamondfox botnet stealer

DiamondFox payload

Diamondfox family

DiamondFox

DiamondFox payload

Executes dropped EXE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2022-05-12 15:07

Signatures

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Diamondfox family

diamondfox

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-12 15:07

Reported

2022-05-12 15:11

Platform

win10v2004-20220414-en

Max time kernel

190s

Max time network

200s

Command Line

"C:\Users\Admin\AppData\Local\Temp\new.exe"

Signatures

DiamondFox

botnet stealer diamondfox

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\new.exe

"C:\Users\Admin\AppData\Local\Temp\new.exe"

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1

Network

Country Destination Domain Proto
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 20.42.65.88:443 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 8.8.8.8:53 acachipalletdiamond.ac udp

Files

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 d0adc891c2d75a5750a0762418fa0f23
SHA1 bfbbc833f3f85d693139b43002181fab5ff8da1d
SHA256 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
SHA512 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f

memory/4920-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 d0adc891c2d75a5750a0762418fa0f23
SHA1 bfbbc833f3f85d693139b43002181fab5ff8da1d
SHA256 0526eaaa777c6f4f30769b2c74105f32b3b70a26b960c2074168f7a7404ede51
SHA512 4ee8af5e556ef6ccefdfecbe43c89c66c9244ea7db1e35b987d35e15090a1e7b8135590544d27dbc37f164bfbb5e7e82aa0463f16618b80fe993cb6b7bff245f

memory/4804-131-0x0000000000000000-mapping.dmp

memory/4920-135-0x00000000023F0000-0x0000000002426000-memory.dmp

memory/4920-136-0x0000000004F10000-0x0000000005538000-memory.dmp

memory/4920-137-0x0000000004E70000-0x0000000004E92000-memory.dmp

memory/4920-138-0x0000000005540000-0x00000000055A6000-memory.dmp

memory/4920-139-0x00000000056E0000-0x0000000005746000-memory.dmp

memory/4920-140-0x0000000005D20000-0x0000000005D3E000-memory.dmp

memory/4920-142-0x00000000741A0000-0x00000000741EC000-memory.dmp

memory/4920-141-0x0000000006EE0000-0x0000000006F12000-memory.dmp

memory/4920-143-0x00000000062D0000-0x00000000062EE000-memory.dmp

memory/4920-144-0x0000000007660000-0x0000000007CDA000-memory.dmp

memory/4920-145-0x0000000006000000-0x000000000601A000-memory.dmp

memory/4920-146-0x00000000070A0000-0x00000000070AA000-memory.dmp

memory/4920-147-0x00000000072B0000-0x0000000007346000-memory.dmp

memory/4920-148-0x0000000007020000-0x000000000702E000-memory.dmp

memory/4920-149-0x0000000004EA0000-0x0000000004EBA000-memory.dmp

memory/4920-150-0x0000000000690000-0x0000000000698000-memory.dmp