diamondfox | c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2023, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe
Size 260KB
Sample230129-yd3m1abb96
SHA256 c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769
MD5 f792fde5cbdc10687e9858778866e89d
SHA1 9e3ec7dbc7b14607fbd9308f66307a36a41024db
SHA512 bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475
SSDEEP 6144:GrsKkfPhLCay2XnlehQQjABRqmx8rn/OuG:gsKQPh3y4ehQQYj8a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral2/memory/4636-133-0x0000000000CB0000-0x0000000000CE3000-memory.dmp	diamondfox
behavioral2/memory/4636-134-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/4408-139-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/4408-143-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

pid	Process
4408	MicrosoftEdgeCPS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4152	4636	WerFault.exe	79
2620	4408	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	80
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	80
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	80

C:\Users\Admin\AppData\Local\Temp\c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe
"C:\Users\Admin\AppData\Local\Temp\c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1352
    3⤵
    - Program crash
    PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 576
  2⤵
  - Program crash
  PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4636 -ip 4636
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4408 -ip 4408
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeCPS.exe

Path C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
Size 260KB
SHA256 c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769
MD5 f792fde5cbdc10687e9858778866e89d
SHA1 9e3ec7dbc7b14607fbd9308f66307a36a41024db
SHA512 bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475
SSDEEP 6144:GrsKkfPhLCay2XnlehQQjABRqmx8rn/OuG:gsKQPh3y4ehQQYj8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeCPS.exe

Path C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
Size 260KB
SHA256 c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769
MD5 f792fde5cbdc10687e9858778866e89d
SHA1 9e3ec7dbc7b14607fbd9308f66307a36a41024db
SHA512 bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475
SSDEEP 6144:GrsKkfPhLCay2XnlehQQjABRqmx8rn/OuG:gsKQPh3y4ehQQYj8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4408-138-0x0000000000936000-0x0000000000954000-memory.dmp

Download

memory/4408-139-0x0000000000400000-0x000000000083B000-memory.dmp

Download

memory/4408-141-0x0000000000936000-0x0000000000954000-memory.dmp

Download

memory/4408-142-0x0000000000936000-0x0000000000954000-memory.dmp

Download

memory/4408-143-0x0000000000400000-0x000000000083B000-memory.dmp

Download

memory/4636-132-0x0000000000AC7000-0x0000000000AE5000-memory.dmp

Download

memory/4636-133-0x0000000000CB0000-0x0000000000CE3000-memory.dmp

Download

memory/4636-134-0x0000000000400000-0x000000000083B000-memory.dmp

Download

memory/4636-140-0x0000000000AC7000-0x0000000000AE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads