phoenixstealer | 114597ce6ce72d2e30ba0d86e20562c2e6b477838d30ed6ec998f315573bc1ba | Triage

Analysis

max time kernel
89s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 15:39

Sharing

Report Analysis Logs

General

Target

terror.exe
Size

4.1MB
MD5

77dd31adbf6895ba075fa0e4864b0017
SHA1

bed7e4ae5247c536868a4474c640fe808dc05bf7
SHA256

114597ce6ce72d2e30ba0d86e20562c2e6b477838d30ed6ec998f315573bc1ba
SHA512

dc7c4ec8a9f6d091d263713b5c321318c44844126e64ae51ca4d73ea85424854f382ba7ee34c96290c1eab44433bbfbcf23f467245ae64f58b5640db4cf8a630

Score

10^/10

phoenixstealer stealer

Malware Config

Signatures

PhoenixStealer
PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
stealer phoenixstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 223020	4704	terror.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83
PID 4704 wrote to memory of 223020	4704	terror.exe	83

C:\Users\Admin\AppData\Local\Temp\terror.exe
"C:\Users\Admin\AppData\Local\Temp\terror.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:223020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-130-0x0000000000400000-0x0000000000B55000-memory.dmp

Filesize
7.3MB

Download
memory/223020-135-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/223020-142-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download