diamondfox | 0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe
Size

330KB
MD5

f496c839f762140fc275be29a1307efe
SHA1

b60b56caef87f24d07db7313d2e90011b662cb68
SHA256

0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474
SHA512

0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068
SSDEEP

6144:vjyPFc4tqecJ1+bKK8OPdCb7YuJNpas5wV9Su8AxVqAm:7R4tzgYbF8OPd0zJNss6GAWA

Score

10^/10

diamondfox botnet infostealer stealer

Malware Config

Signatures

DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 5 IoCs

Detects DiamondFox payload in file/memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/4344-133-0x00000000001C0000-0x00000000001F3000-memory.dmp	diamondfox
behavioral2/memory/4344-134-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox
behavioral2/memory/632-139-0x0000000002B00000-0x0000000002B33000-memory.dmp	diamondfox
behavioral2/memory/632-140-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox
behavioral2/memory/632-143-0x0000000000400000-0x0000000002AF4000-memory.dmp	diamondfox

Executes dropped EXE 1 IoCs

Processes:

MicrosoftEdgeCPS.exe

pid	Process
632	MicrosoftEdgeCPS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2136	4344	WerFault.exe	79
3940	632	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe

description	pid	Process	procid_target
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83
PID 4344 wrote to memory of 632	4344	0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe	83

C:\Users\Admin\AppData\Local\Temp\0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe
"C:\Users\Admin\AppData\Local\Temp\0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  2⤵
  - Executes dropped EXE
  PID:632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 1336
    3⤵
    - Program crash
    PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 620
  2⤵
  - Program crash
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4344 -ip 4344
1⤵
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 632 -ip 632
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
330KB

MD5
f496c839f762140fc275be29a1307efe

SHA1
b60b56caef87f24d07db7313d2e90011b662cb68

SHA256
0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474

SHA512
0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068

Download Submit
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

Filesize
330KB

MD5
f496c839f762140fc275be29a1307efe

SHA1
b60b56caef87f24d07db7313d2e90011b662cb68

SHA256
0aff63230dac9ca248ddcb00bb998cc318c93b9101365558c003c21a7fd5c474

SHA512
0a2c6052bbaf5b4bfbd310f73ab4d967956f3bb4cd37503a9ac58e2a181b6255864710565fd4be65f2302eaca5f5789e8993da8bd4687dc906485890e1e7e068

Download Submit
memory/632-135-0x0000000000000000-mapping.dmp

Download
memory/632-138-0x0000000002B82000-0x0000000002BA0000-memory.dmp

Filesize
120KB

Download
memory/632-139-0x0000000002B00000-0x0000000002B33000-memory.dmp

Filesize
204KB

Download
memory/632-140-0x0000000000400000-0x0000000002AF4000-memory.dmp

Filesize
39.0MB

Download
memory/632-142-0x0000000002B82000-0x0000000002BA0000-memory.dmp

Filesize
120KB

Download
memory/632-143-0x0000000000400000-0x0000000002AF4000-memory.dmp

Filesize
39.0MB

Download
memory/4344-132-0x0000000002DA3000-0x0000000002DC1000-memory.dmp

Filesize
120KB

Download
memory/4344-133-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download
memory/4344-134-0x0000000000400000-0x0000000002AF4000-memory.dmp

Filesize
39.0MB

Download
memory/4344-141-0x0000000002DA3000-0x0000000002DC1000-memory.dmp

Filesize
120KB

Download