diamondfox | 0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2023, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe
Size 330KB
Sample230129-yd4v3acf61
SHA256 0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474
MD5 f496c839f762140fc275be29a1307efe
SHA1 b60b56caef87f24d07db7313d2e90011b662cb68
SHA512 0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068
SSDEEP 6144:vjyPFc4tqecJ1+bKK8OPdCb7YuJNpas5wV9Su8AxVqAm:7R4tzgYbF8OPd0zJNss6GAWA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 5 IoCs

Detects DiamondFox payload in file/memory.

infostealer

resource	yara_rule
behavioral2/memory/4344-133-0x00000000001C0000-0x00000000001F3000-memory.dmp	diamondfox
behavioral2/memory/4344-134-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox
behavioral2/memory/632-139-0x0000000002B00000-0x0000000002B33000-memory.dmp	diamondfox
behavioral2/memory/632-140-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox
behavioral2/memory/632-143-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

pid	Process
632	MicrosoftEdgeCPS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2136	4344	WerFault.exe	79
3940	632	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83

C:\Users\Admin\AppData\Local\Temp\0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe
"C:\Users\Admin\AppData\Local\Temp\0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  PID:632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 1336
    3⤵
    - Program crash
    PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 620
  2⤵
  - Program crash
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4344 -ip 4344
1⤵
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 632 -ip 632
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeCPS.exe

Path C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
Size 330KB
SHA256 0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474
MD5 f496c839f762140fc275be29a1307efe
SHA1 b60b56caef87f24d07db7313d2e90011b662cb68
SHA512 0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068
SSDEEP 6144:vjyPFc4tqecJ1+bKK8OPdCb7YuJNpas5wV9Su8AxVqAm:7R4tzgYbF8OPd0zJNss6GAWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeCPS.exe

Path C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
Size 330KB
SHA256 0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474
MD5 f496c839f762140fc275be29a1307efe
SHA1 b60b56caef87f24d07db7313d2e90011b662cb68
SHA512 0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068
SSDEEP 6144:vjyPFc4tqecJ1+bKK8OPdCb7YuJNpas5wV9Su8AxVqAm:7R4tzgYbF8OPd0zJNss6GAWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-138-0x0000000002B82000-0x0000000002BA0000-memory.dmp

Download

memory/632-139-0x0000000002B00000-0x0000000002B33000-memory.dmp

Download

memory/632-140-0x0000000000400000-0x0000000002AF4000-memory.dmp

Download

memory/632-142-0x0000000002B82000-0x0000000002BA0000-memory.dmp

Download

memory/632-143-0x0000000000400000-0x0000000002AF4000-memory.dmp

Download

memory/4344-132-0x0000000002DA3000-0x0000000002DC1000-memory.dmp

Download

memory/4344-133-0x00000000001C0000-0x00000000001F3000-memory.dmp

Download

memory/4344-134-0x0000000000400000-0x0000000002AF4000-memory.dmp

Download

memory/4344-141-0x0000000002DA3000-0x0000000002DC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads