diamondfox | c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe
Size

260KB
MD5

f792fde5cbdc10687e9858778866e89d
SHA1

9e3ec7dbc7b14607fbd9308f66307a36a41024db
SHA256

c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769
SHA512

bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475
SSDEEP

6144:GrsKkfPhLCay2XnlehQQjABRqmx8rn/OuG:gsKQPh3y4ehQQYj8a

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 4 IoCs

Detects DiamondFox payload in file/memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/4636-133-0x0000000000CB0000-0x0000000000CE3000-memory.dmp	diamondfox
behavioral2/memory/4636-134-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/4408-139-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox
behavioral2/memory/4408-143-0x0000000000400000-0x000000000083B000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

Processes:

MicrosoftEdgeCPS.exe

pid process

4408 MicrosoftEdgeCPS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4408	MicrosoftEdgeCPS.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4152	4636	WerFault.exe	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe
2620	4408	WerFault.exe	MicrosoftEdgeCPS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe

description	pid	process	target process
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	MicrosoftEdgeCPS.exe
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	MicrosoftEdgeCPS.exe
PID 4636 wrote to memory of 4408	4636	c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe	MicrosoftEdgeCPS.exe

C:\Users\Admin\AppData\Local\Temp\c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe
"C:\Users\Admin\AppData\Local\Temp\c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1352
    3⤵
    - Program crash
    PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 576
  2⤵
  - Program crash
  PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4636 -ip 4636
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4408 -ip 4408
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
260KB

MD5
f792fde5cbdc10687e9858778866e89d

SHA1
9e3ec7dbc7b14607fbd9308f66307a36a41024db

SHA256
c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769

SHA512
bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
260KB

MD5
f792fde5cbdc10687e9858778866e89d

SHA1
9e3ec7dbc7b14607fbd9308f66307a36a41024db

SHA256
c481825776c06d28a2e1797c6b48d86b84132274f5c91f5a7f27f959a28d6769

SHA512
bde3691e128e79067ae8fbe554b3181895947a24b5f016fd989ad6e8d3eaa6ae083e8c19e78bd70776c6411b80406b20f64a2ac3125783fb3be4f86b727e4475

Download Submit
memory/4408-135-0x0000000000000000-mapping.dmp

Download
memory/4408-138-0x0000000000936000-0x0000000000954000-memory.dmp

Filesize
120KB

Download
memory/4408-139-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/4408-141-0x0000000000936000-0x0000000000954000-memory.dmp

Filesize
120KB

Download
memory/4408-142-0x0000000000936000-0x0000000000954000-memory.dmp

Filesize
120KB

Download
memory/4408-143-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/4636-132-0x0000000000AC7000-0x0000000000AE5000-memory.dmp

Filesize
120KB

Download
memory/4636-133-0x0000000000CB0000-0x0000000000CE3000-memory.dmp

Filesize
204KB

Download
memory/4636-134-0x0000000000400000-0x000000000083B000-memory.dmp

Filesize
4.2MB

Download
memory/4636-140-0x0000000000AC7000-0x0000000000AE5000-memory.dmp

Filesize
120KB

Download