phoenixstealer | 6b3260201ea9fb85f2374c809140463ae0e47398c1c8a0c07e54724f82a34c71

Analysis

Target

52768773.exe
Size

1.1MB
MD5

cab000059d249508c491d28e0fecc84e
SHA1

12ab2f870432381662ca2c3390026b585a3a3422
SHA256

6b3260201ea9fb85f2374c809140463ae0e47398c1c8a0c07e54724f82a34c71
SHA512

9f3963dd8ed36d3c90bb151aa5a0e327c2984c09c8c0d1cd2cf5e372043217794e6b6de668ee53e4ae699d595efec41de51c350e60f79f34c01ed431218d19be

Score

10^/10

PhoenixStealer
PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
stealer phoenixstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 1976	1088	52768773.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28
PID 1088 wrote to memory of 1976	1088	52768773.exe	28

C:\Users\Admin\AppData\Local\Temp\52768773.exe
"C:\Users\Admin\AppData\Local\Temp\52768773.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1976

memory/1088-54-0x0000000000390000-0x00000000003F0000-memory.dmp

Filesize
384KB

Download
memory/1088-55-0x00000000034D0000-0x00000000034D3000-memory.dmp

Filesize
12KB

Download
memory/1976-56-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1976-58-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1976-66-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1976-67-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1976-68-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download