diamondfox | 99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe
Size

259KB
MD5

16ee0affd90564a4bc174144b100af1b
SHA1

218c7b919ce938ab78afa6979895250f1f1cdea8
SHA256

99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a
SHA512

856970fa108ed79d21d786416c7177c9d4d9ea3a87f8863a18406d32e7cceca7b1cd73013467e995d3f634bd46688a096393160205750ad2345a998225d533a3
SSDEEP

6144:L8SHY14PRLaHOmOFWRVwQDDZO9fT32bn/VS:LvHYqPRKOmOFWAK1QfTc

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/4808-133-0x0000000000950000-0x0000000000983000-memory.dmp	diamondfox
behavioral2/memory/4808-134-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/1428-139-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/1428-143-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

Processes:

MicrosoftEdgeCPS.exe

pid	Process
1428	MicrosoftEdgeCPS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4916	4808	WerFault.exe	79
4764	1428	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe

description	pid	Process	procid_target
PID 4808 wrote to memory of 1428	4808	99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe	80
PID 4808 wrote to memory of 1428	4808	99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe	80
PID 4808 wrote to memory of 1428	4808	99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe	80

C:\Users\Admin\AppData\Local\Temp\99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe
"C:\Users\Admin\AppData\Local\Temp\99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1336
    3⤵
    - Program crash
    PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 616
  2⤵
  - Program crash
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4808 -ip 4808
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1428 -ip 1428
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
259KB

MD5
16ee0affd90564a4bc174144b100af1b

SHA1
218c7b919ce938ab78afa6979895250f1f1cdea8

SHA256
99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a

SHA512
856970fa108ed79d21d786416c7177c9d4d9ea3a87f8863a18406d32e7cceca7b1cd73013467e995d3f634bd46688a096393160205750ad2345a998225d533a3

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
259KB

MD5
16ee0affd90564a4bc174144b100af1b

SHA1
218c7b919ce938ab78afa6979895250f1f1cdea8

SHA256
99dc3fa5b1eb7771475721fbfb981615126ccb11e51bd0f8375735f1eedf9d7a

SHA512
856970fa108ed79d21d786416c7177c9d4d9ea3a87f8863a18406d32e7cceca7b1cd73013467e995d3f634bd46688a096393160205750ad2345a998225d533a3

Download Submit
memory/1428-135-0x0000000000000000-mapping.dmp

Download
memory/1428-138-0x0000000000906000-0x0000000000924000-memory.dmp

Filesize
120KB

Download
memory/1428-139-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/1428-141-0x0000000000906000-0x0000000000924000-memory.dmp

Filesize
120KB

Download
memory/1428-142-0x0000000000906000-0x0000000000924000-memory.dmp

Filesize
120KB

Download
memory/1428-143-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/4808-132-0x0000000000BA7000-0x0000000000BC5000-memory.dmp

Filesize
120KB

Download
memory/4808-133-0x0000000000950000-0x0000000000983000-memory.dmp

Filesize
204KB

Download
memory/4808-134-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/4808-140-0x0000000000BA7000-0x0000000000BC5000-memory.dmp

Filesize
120KB

Download