phoenixstealer | 0e9bd347ccbbd15dfcaeb2b245cda326b4e3e6dfbeff404e02e483ee34368117

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 19:01

Target

CANVA CRACK PRO.exe
Size

4.0MB
MD5

c95dcd2ed3cf1b51eb5f7293f590f99c
SHA1

f1a6565d6c784546d9a813993e299d4c77222ce9
SHA256

506b67c64e2482e03bcf84d48e341fb25582d9a066ef7b0750aeee180395f497
SHA512

3811fbe106eea48eef549280649ee70915f2c63634d836f74d10e19e9415ccb42c681922dcf2dc988d802f5c5f68fd48bd10b5e551e01dbdb92883966f3e8669
SSDEEP

49152:/Sl61ywhE5Hgljvz5PrOeafe29D+MJclCNv2:/pi5Hgvz5yei9KMJclyv2

Score

10^/10

PhoenixStealer
PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
stealer phoenixstealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

CANVA CRACK PRO.exe

description	pid	Process	procid_target
PID 1324 set thread context of 188308	1324	CANVA CRACK PRO.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

CANVA CRACK PRO.exe

description	pid	Process	procid_target
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28
PID 1324 wrote to memory of 188308	1324	CANVA CRACK PRO.exe	28

C:\Users\Admin\AppData\Local\Temp\CANVA CRACK PRO.exe
"C:\Users\Admin\AppData\Local\Temp\CANVA CRACK PRO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:188308

memory/188308-54-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/188308-56-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/188308-63-0x0000000000454CB9-mapping.dmp

Download
memory/188308-64-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/188308-65-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/188308-66-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download