Analysis
- max time kernel
84s - max time network
90s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 04:33
General
- Target diamondfox_2.exe
- Size 203KB
- Sample240212-e6qpcsab5v
- SHA256 06e55f0700b583a63f0778201bf4f1ac352966f9c4fa47b5bbd7f39c08b68b79
Malware Config
Signatures
- DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
- DiamondFox payload 1 IoCs
Detects DiamondFox payload in file/memory.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 29 IoCs
- Suspicious use of SendNotifyMessage 29 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe' -Force -Recurse2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe' -Force -Recurse2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hp5i5lr3.1yc.ps1
MicrosoftEdgeCPS.exe
memory/1160-12-0x00000000052A0000-0x00000000052C2000-memory.dmp
memory/1160-9-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/1160-112-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/1160-58-0x0000000004FB0000-0x0000000004FCE000-memory.dmp
memory/1160-13-0x0000000005BC0000-0x0000000005C26000-memory.dmp
memory/1160-108-0x0000000008520000-0x0000000008AC4000-memory.dmp
memory/1160-7-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/1160-107-0x0000000006880000-0x00000000068A2000-memory.dmp
memory/1160-95-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/1160-65-0x0000000006710000-0x000000000672A000-memory.dmp
memory/1160-62-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/1160-61-0x00000000078F0000-0x0000000007F6A000-memory.dmp
memory/1160-6-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/2268-39-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/2268-116-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/2268-105-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/2268-38-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/2268-117-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/2268-113-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/2268-66-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/2268-35-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/3244-98-0x0000000007740000-0x0000000007754000-memory.dmp
memory/3244-81-0x000000006FA60000-0x000000006FAAC000-memory.dmp
memory/3244-36-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/3244-103-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/3244-63-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3244-37-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3436-127-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-119-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-120-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-118-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-125-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-124-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-126-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-129-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-128-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/3436-130-0x0000028EB9710000-0x0000028EB9711000-memory.dmp
memory/4420-99-0x0000000007190000-0x00000000071AA000-memory.dmp
memory/4420-100-0x0000000007170000-0x0000000007178000-memory.dmp
memory/4420-104-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/4420-59-0x0000000006080000-0x00000000060CC000-memory.dmp
memory/4420-33-0x0000000005530000-0x0000000005884000-memory.dmp
memory/4420-14-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/4420-11-0x0000000004C70000-0x0000000005298000-memory.dmp
memory/4420-10-0x0000000004630000-0x0000000004640000-memory.dmp
memory/4420-8-0x0000000004570000-0x00000000045A6000-memory.dmp
memory/4420-97-0x0000000007080000-0x000000000708E000-memory.dmp
memory/4420-5-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/4420-96-0x0000000004630000-0x0000000004640000-memory.dmp
memory/4420-94-0x0000000007050000-0x0000000007061000-memory.dmp
memory/4420-93-0x00000000070D0000-0x0000000007166000-memory.dmp
memory/4420-92-0x0000000006EC0000-0x0000000006ECA000-memory.dmp
memory/4420-91-0x0000000006B00000-0x0000000006BA3000-memory.dmp
memory/4420-80-0x0000000004630000-0x0000000004640000-memory.dmp
memory/4420-79-0x00000000060F0000-0x000000000610E000-memory.dmp
memory/4420-64-0x0000000073480000-0x0000000073C30000-memory.dmp
memory/4420-69-0x000000006FA60000-0x000000006FAAC000-memory.dmp
memory/4420-67-0x0000000006110000-0x0000000006142000-memory.dmp
memory/4420-68-0x000000007EF80000-0x000000007EF90000-memory.dmp
memory/4420-60-0x0000000004630000-0x0000000004640000-memory.dmp