Analysis Overview
SHA256
e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254
Threat Level: Known bad
The file 040 was found to be: Known bad.
Malicious Activity Summary
DiamondFox payload
Diamondfox family
DiamondFox
DiamondFox payload
Executes dropped EXE
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-03-23 02:18
Signatures
DiamondFox payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Diamondfox family
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-23 02:18
Reported
2023-03-23 02:18
Platform
win7-20230220-en
Max time kernel
4s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\040.exe
"C:\Users\Admin\AppData\Local\Temp\040.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2023-03-23 02:18
Reported
2023-03-23 02:18
Platform
win10v2004-20230220-en
Max time kernel
30s
Max time network
32s
Command Line
Signatures
DiamondFox
DiamondFox payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2052 wrote to memory of 3216 | N/A | C:\Users\Admin\AppData\Local\Temp\040.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 2052 wrote to memory of 3216 | N/A | C:\Users\Admin\AppData\Local\Temp\040.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 2052 wrote to memory of 3216 | N/A | C:\Users\Admin\AppData\Local\Temp\040.exe | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe |
| PID 3216 wrote to memory of 980 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 3216 wrote to memory of 980 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 3216 wrote to memory of 980 | N/A | C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\040.exe
"C:\Users\Admin\AppData\Local\Temp\040.exe"
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 240.232.18.117.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.145.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | acachipalletdiamond.ac | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
| MD5 | 433d77782664455b950e1508c0787f1a |
| SHA1 | 181103f2b8dd9a8bf954f22670f08c7193cb8e8f |
| SHA256 | e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254 |
| SHA512 | 5c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390 |
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
| MD5 | 433d77782664455b950e1508c0787f1a |
| SHA1 | 181103f2b8dd9a8bf954f22670f08c7193cb8e8f |
| SHA256 | e3be8bb6d3f2e7bd860e41df6a60e1a5698bec5670ea127b627ef8b16fb0d254 |
| SHA512 | 5c8da80d17e2a023d2bb2621ec14d97412fd02a9c645044e1c4818c4e55c29e8fc5ad4cae30817d4e6e45d52e3fdd44b8581be0e411b74fff26e7ae44008d390 |
memory/980-138-0x0000000002B10000-0x0000000002B46000-memory.dmp
memory/980-139-0x0000000005760000-0x0000000005D88000-memory.dmp
memory/980-140-0x0000000005120000-0x0000000005130000-memory.dmp
memory/980-141-0x0000000005120000-0x0000000005130000-memory.dmp
memory/980-142-0x0000000005540000-0x0000000005562000-memory.dmp
memory/980-143-0x0000000005D90000-0x0000000005DF6000-memory.dmp
memory/980-144-0x0000000005E00000-0x0000000005E66000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ezbizxc.xej.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/980-154-0x0000000006400000-0x000000000641E000-memory.dmp
memory/980-155-0x0000000005120000-0x0000000005130000-memory.dmp
memory/980-156-0x00000000069C0000-0x00000000069F2000-memory.dmp
memory/980-157-0x0000000070640000-0x000000007068C000-memory.dmp
memory/980-167-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/980-168-0x0000000007D50000-0x00000000083CA000-memory.dmp
memory/980-169-0x0000000007700000-0x000000000771A000-memory.dmp
memory/980-170-0x000000007F530000-0x000000007F540000-memory.dmp
memory/980-171-0x0000000007770000-0x000000000777A000-memory.dmp
memory/980-172-0x0000000007980000-0x0000000007A16000-memory.dmp
memory/980-173-0x0000000007930000-0x000000000793E000-memory.dmp
memory/980-174-0x0000000007A40000-0x0000000007A5A000-memory.dmp
memory/980-175-0x0000000007A20000-0x0000000007A28000-memory.dmp