Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 02:18
Behavioral task
behavioral1
Sample
040.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
040.exe
Resource
win10v2004-20230220-en
General
-
Target
040.exe
-
Size
212KB
-
MD5
433d77782664455b950e1508c0787f1a
-
SHA1
181103f2b8dd9a8bf954f22670f08c7193cb8e8f
-
SHA256
e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
-
SHA512
5c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390
-
SSDEEP
6144:BOHeBWJdskGtgUSxE916KEqYmFjvTBi9g6l:BO+B4it8xokZmFjvToKA
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox -
Executes dropped EXE 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 3216 MicrosoftEdgeCPS.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 980 powershell.exe 980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 980 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
040.exeMicrosoftEdgeCPS.exedescription pid process target process PID 2052 wrote to memory of 3216 2052 040.exe MicrosoftEdgeCPS.exe PID 2052 wrote to memory of 3216 2052 040.exe MicrosoftEdgeCPS.exe PID 2052 wrote to memory of 3216 2052 040.exe MicrosoftEdgeCPS.exe PID 3216 wrote to memory of 980 3216 MicrosoftEdgeCPS.exe powershell.exe PID 3216 wrote to memory of 980 3216 MicrosoftEdgeCPS.exe powershell.exe PID 3216 wrote to memory of 980 3216 MicrosoftEdgeCPS.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\040.exe"C:\Users\Admin\AppData\Local\Temp\040.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ezbizxc.xej.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeFilesize
212KB
MD5433d77782664455b950e1508c0787f1a
SHA1181103f2b8dd9a8bf954f22670f08c7193cb8e8f
SHA256e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
SHA5125c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeFilesize
212KB
MD5433d77782664455b950e1508c0787f1a
SHA1181103f2b8dd9a8bf954f22670f08c7193cb8e8f
SHA256e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
SHA5125c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390
-
memory/980-154-0x0000000006400000-0x000000000641E000-memory.dmpFilesize
120KB
-
memory/980-156-0x00000000069C0000-0x00000000069F2000-memory.dmpFilesize
200KB
-
memory/980-141-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/980-142-0x0000000005540000-0x0000000005562000-memory.dmpFilesize
136KB
-
memory/980-143-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/980-144-0x0000000005E00000-0x0000000005E66000-memory.dmpFilesize
408KB
-
memory/980-139-0x0000000005760000-0x0000000005D88000-memory.dmpFilesize
6.2MB
-
memory/980-138-0x0000000002B10000-0x0000000002B46000-memory.dmpFilesize
216KB
-
memory/980-155-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/980-140-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/980-157-0x0000000070640000-0x000000007068C000-memory.dmpFilesize
304KB
-
memory/980-167-0x00000000069A0000-0x00000000069BE000-memory.dmpFilesize
120KB
-
memory/980-168-0x0000000007D50000-0x00000000083CA000-memory.dmpFilesize
6.5MB
-
memory/980-169-0x0000000007700000-0x000000000771A000-memory.dmpFilesize
104KB
-
memory/980-170-0x000000007F530000-0x000000007F540000-memory.dmpFilesize
64KB
-
memory/980-171-0x0000000007770000-0x000000000777A000-memory.dmpFilesize
40KB
-
memory/980-172-0x0000000007980000-0x0000000007A16000-memory.dmpFilesize
600KB
-
memory/980-173-0x0000000007930000-0x000000000793E000-memory.dmpFilesize
56KB
-
memory/980-174-0x0000000007A40000-0x0000000007A5A000-memory.dmpFilesize
104KB
-
memory/980-175-0x0000000007A20000-0x0000000007A28000-memory.dmpFilesize
32KB