phoenixstealer | 114597ce6ce72d2e30ba0d86e20562c2e6b477838d30ed6ec998f315573bc1ba

Analysis

max time kernel
89s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 15:39

Target
terror.exe
Size 4.1MB
Sample220811-s3meeshacl
SHA256 114597ce6ce72d2e30ba0d86e20562c2e6b477838d30ed6ec998f315573bc1ba
MD5 77dd31adbf6895ba075fa0e4864b0017
SHA1 bed7e4ae5247c536868a4474c640fe808dc05bf7
SHA512 dc7c4ec8a9f6d091d263713b5c321318c44844126e64ae51ca4d73ea85424854f382ba7ee34c96290c1eab44433bbfbcf23f467245ae64f58b5640db4cf8a630
MD5 SHA1 SHA512

Score

10^/10

PhoenixStealer
PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
stealer phoenixstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 223020	4704	terror.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83

C:\Users\Admin\AppData\Local\Temp\terror.exe
"C:\Users\Admin\AppData\Local\Temp\terror.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:223020

memory/4704-130-0x0000000000400000-0x0000000000B55000-memory.dmp

Download

memory/223020-135-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/223020-142-0x0000000000400000-0x000000000048E000-memory.dmp

Download