Malware Analysis Report

2024-07-11 07:31

Sample ID 230323-crdp5seh6x
Target 040
SHA256 e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
Tags
infostealer diamondfox botnet stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254

Threat Level: Known bad

The file 040 was found to be: Known bad.

Malicious Activity Summary

infostealer diamondfox botnet stealer

DiamondFox payload

Diamondfox family

DiamondFox

DiamondFox payload

Executes dropped EXE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2023-03-23 02:18

Signatures

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Diamondfox family

diamondfox

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-23 02:18

Reported

2023-03-23 02:18

Platform

win7-20230220-en

Max time kernel

4s

Command Line

"C:\Users\Admin\AppData\Local\Temp\040.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\040.exe

"C:\Users\Admin\AppData\Local\Temp\040.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-23 02:18

Reported

2023-03-23 02:18

Platform

win10v2004-20230220-en

Max time kernel

30s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\040.exe"

Signatures

DiamondFox

botnet stealer diamondfox

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\040.exe

"C:\Users\Admin\AppData\Local\Temp\040.exe"

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.232.18.117.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 141.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 acachipalletdiamond.ac udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 433d77782664455b950e1508c0787f1a
SHA1 181103f2b8dd9a8bf954f22670f08c7193cb8e8f
SHA256 e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
SHA512 5c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 433d77782664455b950e1508c0787f1a
SHA1 181103f2b8dd9a8bf954f22670f08c7193cb8e8f
SHA256 e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
SHA512 5c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390

memory/980-138-0x0000000002B10000-0x0000000002B46000-memory.dmp

memory/980-139-0x0000000005760000-0x0000000005D88000-memory.dmp

memory/980-140-0x0000000005120000-0x0000000005130000-memory.dmp

memory/980-141-0x0000000005120000-0x0000000005130000-memory.dmp

memory/980-142-0x0000000005540000-0x0000000005562000-memory.dmp

memory/980-143-0x0000000005D90000-0x0000000005DF6000-memory.dmp

memory/980-144-0x0000000005E00000-0x0000000005E66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ezbizxc.xej.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/980-154-0x0000000006400000-0x000000000641E000-memory.dmp

memory/980-155-0x0000000005120000-0x0000000005130000-memory.dmp

memory/980-156-0x00000000069C0000-0x00000000069F2000-memory.dmp

memory/980-157-0x0000000070640000-0x000000007068C000-memory.dmp

memory/980-167-0x00000000069A0000-0x00000000069BE000-memory.dmp

memory/980-168-0x0000000007D50000-0x00000000083CA000-memory.dmp

memory/980-169-0x0000000007700000-0x000000000771A000-memory.dmp

memory/980-170-0x000000007F530000-0x000000007F540000-memory.dmp

memory/980-171-0x0000000007770000-0x000000000777A000-memory.dmp

memory/980-172-0x0000000007980000-0x0000000007A16000-memory.dmp

memory/980-173-0x0000000007930000-0x000000000793E000-memory.dmp

memory/980-174-0x0000000007A40000-0x0000000007A5A000-memory.dmp

memory/980-175-0x0000000007A20000-0x0000000007A28000-memory.dmp